{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71"}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"01ba4ea94aaac1c5884c1c5c77e7036655e7fff4021346e273930c2a6c91df3e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["01ba4ea94aaac1c5884c1c5c77e7036655e7fff4021346e273930c2a6c91df3e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a"}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"01ba4ea94aaac1c5884c1c5c77e7036655e7fff4021346e273930c2a6c91df3e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01ba4ea94aaac1c5884c1c5c77e7036655e7fff4021346e273930c2a6c91df3e"}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01ba4ea94aaac1c5884c1c5c77e7036655e7fff4021346e273930c2a6c91df3e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71"}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a"}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01ba4ea94aaac1c5884c1c5c77e7036655e7fff4021346e273930c2a6c91df3e"}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71"}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a"}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5"}
{"level":"info","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5"}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5"}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8bf80bbdd91771ed91c3a24f93fb4640547a47855a9edce800136a7a09fc89c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8bf80bbdd91771ed91c3a24f93fb4640547a47855a9edce800136a7a09fc89c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8bf80bbdd91771ed91c3a24f93fb4640547a47855a9edce800136a7a09fc89c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8bf80bbdd91771ed91c3a24f93fb4640547a47855a9edce800136a7a09fc89c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8bf80bbdd91771ed91c3a24f93fb4640547a47855a9edce800136a7a09fc89c9"}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8bf80bbdd91771ed91c3a24f93fb4640547a47855a9edce800136a7a09fc89c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8bf80bbdd91771ed91c3a24f93fb4640547a47855a9edce800136a7a09fc89c9"}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8bf80bbdd91771ed91c3a24f93fb4640547a47855a9edce800136a7a09fc89c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8bf80bbdd91771ed91c3a24f93fb4640547a47855a9edce800136a7a09fc89c9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8bf80bbdd91771ed91c3a24f93fb4640547a47855a9edce800136a7a09fc89c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8bf80bbdd91771ed91c3a24f93fb4640547a47855a9edce800136a7a09fc89c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8bf80bbdd91771ed91c3a24f93fb4640547a47855a9edce800136a7a09fc89c9"}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6"}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6"}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2"}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2"}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6"}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6"}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ebf71e84a353bc9cf2c77da0fb77a780e2a3560248a7a775407322570614cd6f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ebf71e84a353bc9cf2c77da0fb77a780e2a3560248a7a775407322570614cd6f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ebf71e84a353bc9cf2c77da0fb77a780e2a3560248a7a775407322570614cd6f"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ebf71e84a353bc9cf2c77da0fb77a780e2a3560248a7a775407322570614cd6f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ebf71e84a353bc9cf2c77da0fb77a780e2a3560248a7a775407322570614cd6f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ebf71e84a353bc9cf2c77da0fb77a780e2a3560248a7a775407322570614cd6f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ebf71e84a353bc9cf2c77da0fb77a780e2a3560248a7a775407322570614cd6f"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ebf71e84a353bc9cf2c77da0fb77a780e2a3560248a7a775407322570614cd6f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"14d2ea5722ad34833030522fceebe1d7d713e7b8f6fe1634e3d6c3cab16e916a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/14d2ea5722ad34833030522fceebe1d7d713e7b8f6fe1634e3d6c3cab16e916a"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"14d2ea5722ad34833030522fceebe1d7d713e7b8f6fe1634e3d6c3cab16e916a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a294fdfc6a3c3869b96d064a6eff16c0b409c0b1087226224e351a5508bdb978"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/14d2ea5722ad34833030522fceebe1d7d713e7b8f6fe1634e3d6c3cab16e916a"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80cde54f2a9f36a8ea5f51be872b13f10197b86f7e3d704d49840003cbc75e33"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56179ded81d56fea62f350cc1c8f73ee4b21113370722fa0560b2f9110738724"}
{"level":"info","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a294fdfc6a3c3869b96d064a6eff16c0b409c0b1087226224e351a5508bdb978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a294fdfc6a3c3869b96d064a6eff16c0b409c0b1087226224e351a5508bdb978"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/83895478821f18110f9f049dd56c8c7fbaa40e380896b6751fec661d7d80ba66"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a294fdfc6a3c3869b96d064a6eff16c0b409c0b1087226224e351a5508bdb978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"14d2ea5722ad34833030522fceebe1d7d713e7b8f6fe1634e3d6c3cab16e916a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["14d2ea5722ad34833030522fceebe1d7d713e7b8f6fe1634e3d6c3cab16e916a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a294fdfc6a3c3869b96d064a6eff16c0b409c0b1087226224e351a5508bdb978"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"14d2ea5722ad34833030522fceebe1d7d713e7b8f6fe1634e3d6c3cab16e916a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"80cde54f2a9f36a8ea5f51be872b13f10197b86f7e3d704d49840003cbc75e33","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["80cde54f2a9f36a8ea5f51be872b13f10197b86f7e3d704d49840003cbc75e33"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/932521c0ef24457e8da817ce1545bf926406c47e5e4930736d06a9a1dc8fb723"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/14d2ea5722ad34833030522fceebe1d7d713e7b8f6fe1634e3d6c3cab16e916a"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"80cde54f2a9f36a8ea5f51be872b13f10197b86f7e3d704d49840003cbc75e33","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56179ded81d56fea62f350cc1c8f73ee4b21113370722fa0560b2f9110738724","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["56179ded81d56fea62f350cc1c8f73ee4b21113370722fa0560b2f9110738724"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80cde54f2a9f36a8ea5f51be872b13f10197b86f7e3d704d49840003cbc75e33"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56179ded81d56fea62f350cc1c8f73ee4b21113370722fa0560b2f9110738724","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"83895478821f18110f9f049dd56c8c7fbaa40e380896b6751fec661d7d80ba66","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["83895478821f18110f9f049dd56c8c7fbaa40e380896b6751fec661d7d80ba66"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/966ff25f21c7323c1f8b59634614e455ce12f0736afe51edd542f2bc4738e31e"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"83895478821f18110f9f049dd56c8c7fbaa40e380896b6751fec661d7d80ba66","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56179ded81d56fea62f350cc1c8f73ee4b21113370722fa0560b2f9110738724"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a294fdfc6a3c3869b96d064a6eff16c0b409c0b1087226224e351a5508bdb978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"932521c0ef24457e8da817ce1545bf926406c47e5e4930736d06a9a1dc8fb723","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["932521c0ef24457e8da817ce1545bf926406c47e5e4930736d06a9a1dc8fb723"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"932521c0ef24457e8da817ce1545bf926406c47e5e4930736d06a9a1dc8fb723","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"14d2ea5722ad34833030522fceebe1d7d713e7b8f6fe1634e3d6c3cab16e916a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80cde54f2a9f36a8ea5f51be872b13f10197b86f7e3d704d49840003cbc75e33","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"966ff25f21c7323c1f8b59634614e455ce12f0736afe51edd542f2bc4738e31e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["966ff25f21c7323c1f8b59634614e455ce12f0736afe51edd542f2bc4738e31e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/83895478821f18110f9f049dd56c8c7fbaa40e380896b6751fec661d7d80ba66"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"966ff25f21c7323c1f8b59634614e455ce12f0736afe51edd542f2bc4738e31e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"56179ded81d56fea62f350cc1c8f73ee4b21113370722fa0560b2f9110738724","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"83895478821f18110f9f049dd56c8c7fbaa40e380896b6751fec661d7d80ba66","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/932521c0ef24457e8da817ce1545bf926406c47e5e4930736d06a9a1dc8fb723"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"932521c0ef24457e8da817ce1545bf926406c47e5e4930736d06a9a1dc8fb723","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/966ff25f21c7323c1f8b59634614e455ce12f0736afe51edd542f2bc4738e31e"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"966ff25f21c7323c1f8b59634614e455ce12f0736afe51edd542f2bc4738e31e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T17:10:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d"}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T17:10:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1"}
{"level":"info","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57718","PortSpecifier":{"PortValue":57718}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57718","PortSpecifier":{"PortValue":57718}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653836,"nanos":866809535},"http":{"id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","method":"POST","headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d2b7ecff-b2eb-4daa-97e5-fd92c6573866","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=790cce3c-73c8-419d-8c05-2438d5a80b42"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e9605353724c"]}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e9605353724c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=790cce3c-73c8-419d-8c05-2438d5a80b42"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d2b7ecff-b2eb-4daa-97e5-fd92c6573866","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"83895478821f18110f9f049dd56c8c7fbaa40e380896b6751fec661d7d80ba66"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-07bb43/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"078a409e-6f5d-4ac3-ac5e-398cd6f317fb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:46392","PortSpecifier":{"PortValue":46392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-1e5534.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:46392","PortSpecifier":{"PortValue":46392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653836,"nanos":915305243},"http":{"id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","method":"POST","headers":{":authority":"e2e-shared-b-1e5534.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d2b7ecff-b2eb-4daa-97e5-fd92c6573866","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=790cce3c-73c8-419d-8c05-2438d5a80b42"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e9605353724c"]}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e9605353724c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=790cce3c-73c8-419d-8c05-2438d5a80b42"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d2b7ecff-b2eb-4daa-97e5-fd92c6573866","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.61:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-1e5534.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1e5534/rate-test-model-1e5534\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1e5534/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af8fe7f2-3e29-460d-80d9-13b823bcda68","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57722","PortSpecifier":{"PortValue":57722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","method":"POST","path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions","host":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57722","PortSpecifier":{"PortValue":57722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653836,"nanos":964962898},"http":{"id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","method":"POST","headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR"}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR\"}"}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","subscription":"e2e-rate-iso-a-c3aa5f","tenant":"e2e-shared-a-07bb43","userId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\",\"requestedSubscription\":\"e2e-rate-iso-a-c3aa5f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-07bb43/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c3aa5f"}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","selected_subscription":"e2e-rate-iso-a-c3aa5f","selected_subscription_key":"ai-tenant-e2e-shared-a-07bb43/e2e-rate-iso-a-c3aa5f@ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d9c4ed2-d8b0-4bf6-b78a-9d69e18105b2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57738","PortSpecifier":{"PortValue":57738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"66254dec-bc0f-48c4-a120-6205cfffba0e","method":"POST","path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions","host":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57738","PortSpecifier":{"PortValue":57738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653838,"nanos":23990280},"http":{"id":"66254dec-bc0f-48c4-a120-6205cfffba0e","method":"POST","headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR"}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR\"}"}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","subscription":"e2e-rate-iso-a-c3aa5f","tenant":"e2e-shared-a-07bb43","userId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\",\"requestedSubscription\":\"e2e-rate-iso-a-c3aa5f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"}}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-07bb43/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c3aa5f"}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","selected_subscription":"e2e-rate-iso-a-c3aa5f","selected_subscription_key":"ai-tenant-e2e-shared-a-07bb43/e2e-rate-iso-a-c3aa5f@ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66254dec-bc0f-48c4-a120-6205cfffba0e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57748","PortSpecifier":{"PortValue":57748}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b666a280-48d9-4287-9ee6-0bc2b7001009","method":"POST","path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions","host":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57748","PortSpecifier":{"PortValue":57748}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653839,"nanos":64338562},"http":{"id":"b666a280-48d9-4287-9ee6-0bc2b7001009","method":"POST","headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR"}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR\"}"}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","subscription":"e2e-rate-iso-a-c3aa5f","tenant":"e2e-shared-a-07bb43","userId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\",\"requestedSubscription\":\"e2e-rate-iso-a-c3aa5f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"}}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-07bb43/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c3aa5f"}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","selected_subscription":"e2e-rate-iso-a-c3aa5f","selected_subscription_key":"ai-tenant-e2e-shared-a-07bb43/e2e-rate-iso-a-c3aa5f@ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b666a280-48d9-4287-9ee6-0bc2b7001009","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57752","PortSpecifier":{"PortValue":57752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","method":"POST","path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions","host":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57752","PortSpecifier":{"PortValue":57752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653840,"nanos":101274258},"http":{"id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","method":"POST","headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR"}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR\"}"}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","subscription":"e2e-rate-iso-a-c3aa5f","tenant":"e2e-shared-a-07bb43","userId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\",\"requestedSubscription\":\"e2e-rate-iso-a-c3aa5f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"}}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-07bb43/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c3aa5f"}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","selected_subscription":"e2e-rate-iso-a-c3aa5f","selected_subscription_key":"ai-tenant-e2e-shared-a-07bb43/e2e-rate-iso-a-c3aa5f@ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70692ae8-1c6e-4fd6-bb62-0b15f73c87fd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57764","PortSpecifier":{"PortValue":57764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","method":"POST","path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions","host":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57764","PortSpecifier":{"PortValue":57764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653841,"nanos":138067952},"http":{"id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","method":"POST","headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR"}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR\"}"}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","subscription":"e2e-rate-iso-a-c3aa5f","tenant":"e2e-shared-a-07bb43","userId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\",\"requestedSubscription\":\"e2e-rate-iso-a-c3aa5f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"}}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-07bb43/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c3aa5f"}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","selected_subscription":"e2e-rate-iso-a-c3aa5f","selected_subscription_key":"ai-tenant-e2e-shared-a-07bb43/e2e-rate-iso-a-c3aa5f@ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a848f31d-cc4e-4251-a0fb-92d971e9de71","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57776","PortSpecifier":{"PortValue":57776}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8c175c9e-441f-4450-8521-05c96f0df46e","method":"POST","path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions","host":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57776","PortSpecifier":{"PortValue":57776}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653842,"nanos":173571400},"http":{"id":"8c175c9e-441f-4450-8521-05c96f0df46e","method":"POST","headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR"}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR\"}"}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","subscription":"e2e-rate-iso-a-c3aa5f","tenant":"e2e-shared-a-07bb43","userId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\",\"requestedSubscription\":\"e2e-rate-iso-a-c3aa5f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"}}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-07bb43/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c3aa5f"}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","selected_subscription":"e2e-rate-iso-a-c3aa5f","selected_subscription_key":"ai-tenant-e2e-shared-a-07bb43/e2e-rate-iso-a-c3aa5f@ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8c175c9e-441f-4450-8521-05c96f0df46e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57782","PortSpecifier":{"PortValue":57782}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a785c596-ae8f-450b-98af-6e0cf21bb601","method":"POST","path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions","host":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57782","PortSpecifier":{"PortValue":57782}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653843,"nanos":209285339},"http":{"id":"a785c596-ae8f-450b-98af-6e0cf21bb601","method":"POST","headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR"}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR\"}"}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","subscription":"e2e-rate-iso-a-c3aa5f","tenant":"e2e-shared-a-07bb43","userId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\",\"requestedSubscription\":\"e2e-rate-iso-a-c3aa5f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"}}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-07bb43/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c3aa5f"}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","selected_subscription":"e2e-rate-iso-a-c3aa5f","selected_subscription_key":"ai-tenant-e2e-shared-a-07bb43/e2e-rate-iso-a-c3aa5f@ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a785c596-ae8f-450b-98af-6e0cf21bb601","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57792","PortSpecifier":{"PortValue":57792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","method":"POST","path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions","host":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:57792","PortSpecifier":{"PortValue":57792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653844,"nanos":242568527},"http":{"id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","method":"POST","headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR"}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JQ0RMcQUNZZ1x6cj_aP2CftZUvIvKruVtQTeAoFVjzddoTbgwwfHOIMjGkYR\"}"}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","subscription":"e2e-rate-iso-a-c3aa5f","tenant":"e2e-shared-a-07bb43","userId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\",\"requestedSubscription\":\"e2e-rate-iso-a-c3aa5f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"}}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-07bb43/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c3aa5f"}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a55f8b41-f04e-4676-ac56-7894a31a7bd3","keyName":"e2e-rate-a-c3aa5f","selected_subscription":"e2e-rate-iso-a-c3aa5f","selected_subscription_key":"ai-tenant-e2e-shared-a-07bb43/e2e-rate-iso-a-c3aa5f@ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c3aa5f","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d4ca209-b46b-40e0-ac25-5f54e46326a3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55840","PortSpecifier":{"PortValue":55840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55840","PortSpecifier":{"PortValue":55840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653852,"nanos":950336937},"http":{"id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","method":"POST","headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d2b7ecff-b2eb-4daa-97e5-fd92c6573866","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=790cce3c-73c8-419d-8c05-2438d5a80b42"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e9605353724c"]}}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e9605353724c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=790cce3c-73c8-419d-8c05-2438d5a80b42"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d2b7ecff-b2eb-4daa-97e5-fd92c6573866","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"83895478821f18110f9f049dd56c8c7fbaa40e380896b6751fec661d7d80ba66"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-07bb43/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b369dcb4-7ee5-484b-9ec0-9f6298d48fe6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:51752","PortSpecifier":{"PortValue":51752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-1e5534.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:51752","PortSpecifier":{"PortValue":51752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653852,"nanos":989305264},"http":{"id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","method":"POST","headers":{":authority":"e2e-shared-b-1e5534.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d2b7ecff-b2eb-4daa-97e5-fd92c6573866","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=790cce3c-73c8-419d-8c05-2438d5a80b42"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e9605353724c"]}}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e9605353724c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=790cce3c-73c8-419d-8c05-2438d5a80b42"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d2b7ecff-b2eb-4daa-97e5-fd92c6573866","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.61:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-1e5534.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1e5534/rate-test-model-1e5534\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1e5534/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02e69eae-4cb0-4539-a9f1-2666c0d8fb25","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55852","PortSpecifier":{"PortValue":55852}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","method":"POST","path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions","host":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55852","PortSpecifier":{"PortValue":55852}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653853,"nanos":18919358},"http":{"id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","method":"POST","headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1EhQ4ekt2skmqXPhh_rbi8FSfQRhy0pCFZx9xnAHJACKB0bqYoNvOpFXxSnja"}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1EhQ4ekt2skmqXPhh_rbi8FSfQRhy0pCFZx9xnAHJACKB0bqYoNvOpFXxSnja\"}"}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d60ac897-b803-44ba-bec5-7e017322e3d8","keyName":"e2e-rate-a-7be439","subscription":"e2e-rate-iso-a-7be439","tenant":"e2e-shared-a-07bb43","userId":"d60ac897-b803-44ba-bec5-7e017322e3d8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\",\"requestedSubscription\":\"e2e-rate-iso-a-7be439\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7be439","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"}}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-07bb43/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7be439"}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d60ac897-b803-44ba-bec5-7e017322e3d8","keyName":"e2e-rate-a-7be439","selected_subscription":"e2e-rate-iso-a-7be439","selected_subscription_key":"ai-tenant-e2e-shared-a-07bb43/e2e-rate-iso-a-7be439@ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7be439","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e2d6c1b-7b78-4c0d-b8bc-9594992a9d2b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55858","PortSpecifier":{"PortValue":55858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","method":"POST","path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions","host":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55858","PortSpecifier":{"PortValue":55858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653854,"nanos":53570877},"http":{"id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","method":"POST","headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1EhQ4ekt2skmqXPhh_rbi8FSfQRhy0pCFZx9xnAHJACKB0bqYoNvOpFXxSnja"}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1EhQ4ekt2skmqXPhh_rbi8FSfQRhy0pCFZx9xnAHJACKB0bqYoNvOpFXxSnja\"}"}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d60ac897-b803-44ba-bec5-7e017322e3d8","keyName":"e2e-rate-a-7be439","subscription":"e2e-rate-iso-a-7be439","tenant":"e2e-shared-a-07bb43","userId":"d60ac897-b803-44ba-bec5-7e017322e3d8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\",\"requestedSubscription\":\"e2e-rate-iso-a-7be439\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7be439","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"}}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-07bb43/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7be439"}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d60ac897-b803-44ba-bec5-7e017322e3d8","keyName":"e2e-rate-a-7be439","selected_subscription":"e2e-rate-iso-a-7be439","selected_subscription_key":"ai-tenant-e2e-shared-a-07bb43/e2e-rate-iso-a-7be439@ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7be439","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70a1cf68-4033-4d4c-9fa5-75f78c5f84f6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55864","PortSpecifier":{"PortValue":55864}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","method":"POST","path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions","host":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55864","PortSpecifier":{"PortValue":55864}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653855,"nanos":88541401},"http":{"id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","method":"POST","headers":{":authority":"e2e-shared-a-07bb43.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1EhQ4ekt2skmqXPhh_rbi8FSfQRhy0pCFZx9xnAHJACKB0bqYoNvOpFXxSnja"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1EhQ4ekt2skmqXPhh_rbi8FSfQRhy0pCFZx9xnAHJACKB0bqYoNvOpFXxSnja\"}"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d60ac897-b803-44ba-bec5-7e017322e3d8","keyName":"e2e-rate-a-7be439","subscription":"e2e-rate-iso-a-7be439","tenant":"e2e-shared-a-07bb43","userId":"d60ac897-b803-44ba-bec5-7e017322e3d8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\",\"requestedSubscription\":\"e2e-rate-iso-a-7be439\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-07bb43.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7be439","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-07bb43/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7be439"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d60ac897-b803-44ba-bec5-7e017322e3d8","keyName":"e2e-rate-a-7be439","selected_subscription":"e2e-rate-iso-a-7be439","selected_subscription_key":"ai-tenant-e2e-shared-a-07bb43/e2e-rate-iso-a-7be439@ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-07bb43","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7be439","namespace":"ai-tenant-e2e-shared-a-07bb43","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-07bb43/rate-test-model-07bb43"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ecb95a4-22c2-4f8e-82ba-5f568e62a5a5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:51768","PortSpecifier":{"PortValue":51768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8838791f-fccd-4178-a76c-c85abb44e24a","method":"POST","path":"/ai-tenant-e2e-shared-b-1e5534/rate-test-model-1e5534/v1/completions","host":"e2e-shared-b-1e5534.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:51768","PortSpecifier":{"PortValue":51768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784653855,"nanos":121156367},"http":{"id":"8838791f-fccd-4178-a76c-c85abb44e24a","method":"POST","headers":{":authority":"e2e-shared-b-1e5534.apps.71bcd21a-80d9-4037-9793-e9605353724c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-1e5534/rate-test-model-1e5534/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SgMQdvdljXfNCtQ9_4fZYTvL04NTTQNHayQGiAwz9hJ3vvMCeSria4lWQSWe"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-1e5534.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SgMQdvdljXfNCtQ9_4fZYTvL04NTTQNHayQGiAwz9hJ3vvMCeSria4lWQSWe\"}"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-1e5534.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"51698300-4f5f-4fb2-8322-e7f6f0593774","keyName":"e2e-rate-b-7be439","subscription":"e2e-rate-iso-b-7be439","tenant":"e2e-shared-b-1e5534","userId":"51698300-4f5f-4fb2-8322-e7f6f0593774","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-1e5534.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-1e5534/rate-test-model-1e5534\",\"requestedSubscription\":\"e2e-rate-iso-b-7be439\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-1e5534.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1e5534","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-7be439","namespace":"ai-tenant-e2e-shared-b-1e5534","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-1e5534/rate-test-model-1e5534"}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1e5534/rate-test-model-1e5534\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1e5534/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-7be439"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"51698300-4f5f-4fb2-8322-e7f6f0593774","keyName":"e2e-rate-b-7be439","selected_subscription":"e2e-rate-iso-b-7be439","selected_subscription_key":"ai-tenant-e2e-shared-b-1e5534/e2e-rate-iso-b-7be439@ai-tenant-e2e-shared-b-1e5534/rate-test-model-1e5534","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1e5534","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-7be439","namespace":"ai-tenant-e2e-shared-b-1e5534","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-1e5534/rate-test-model-1e5534"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T17:10:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8838791f-fccd-4178-a76c-c85abb44e24a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T17:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ed704933b81aa863eb83a276ac548ac59a4518c74eb31397d5a6166da90c4fe8"}
{"level":"info","ts":"2026-07-21T17:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8bf80bbdd91771ed91c3a24f93fb4640547a47855a9edce800136a7a09fc89c9"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/932521c0ef24457e8da817ce1545bf926406c47e5e4930736d06a9a1dc8fb723"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ebf71e84a353bc9cf2c77da0fb77a780e2a3560248a7a775407322570614cd6f"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/367098d736fd9cf4997ca19ec20402e9c9c2dd502008fd5d0ad92e6b89025bad"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/80cde54f2a9f36a8ea5f51be872b13f10197b86f7e3d704d49840003cbc75e33"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b7399ff11db02741474cfd79f097a703d3ea556be39f459402809b6f08d23cf5"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/05435dd270f16ed6896726e58fb410f2942a46664539275df1a289b10c609c6a"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a0c50dcd2a1d296af2d95218a4fde758a90002912b2c870314d7f3001551a2c2"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/01ba4ea94aaac1c5884c1c5c77e7036655e7fff4021346e273930c2a6c91df3e"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/837658c9238dadac2ecc8b39ac308ab8ce0f4d32ca37458146ea503683d525c6"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a294fdfc6a3c3869b96d064a6eff16c0b409c0b1087226224e351a5508bdb978"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3a2a9f2f5458e2cdc5974ced864933b1ef2fccbfb4cc645c1dca6f5fc3fa0957"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/56179ded81d56fea62f350cc1c8f73ee4b21113370722fa0560b2f9110738724"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5020732b6ee9aa27a8a5ef448742678fc82acd77b581fc7b69292e31d9bad26c"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f412682f124d2fdf48c080503cf32c891cdbf7373a625a4b6773c7ec12ff3f33"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/83895478821f18110f9f049dd56c8c7fbaa40e380896b6751fec661d7d80ba66"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8503d80bc3beb6a37125ccbfd50934821ba323ad7b3b84c29c2b35e860657ad1"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/14d2ea5722ad34833030522fceebe1d7d713e7b8f6fe1634e3d6c3cab16e916a"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/749f35920c7c94bb88def1e821ad6be0ad865287573414f14cd69b40c9d7db83"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/966ff25f21c7323c1f8b59634614e455ce12f0736afe51edd542f2bc4738e31e"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/df553bd9a3b543506d544b5a3d5da918ad0bcab98f43df47cd6dc2dc59fb3b71"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7010b93d0329bc41af5e1b4a868b6772e3e7b6c6ad589519f8228cfcb55cecf6"}
{"level":"info","ts":"2026-07-21T17:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ef3bbdc1a0a6953d7b9cdf41a4e94dbc56af07f3b9d12b1d9c0a4cd72c44ea3d"}