{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"}
{"level":"error","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"826b10ce7bf13a80bf12d7824bbebd76c76227b2d5fff66e6df08856ef86d22c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/826b10ce7bf13a80bf12d7824bbebd76c76227b2d5fff66e6df08856ef86d22c"}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6b8da889b2da09bb8714325a0723d4edfa374097693680e289958ecaff408626","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6b8da889b2da09bb8714325a0723d4edfa374097693680e289958ecaff408626"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a"}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"573d412ce45c594b199cf5144c4998dbe91d0a067c2ad02738da48a91fd3131b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a"}
{"level":"info","ts":"2026-07-14T20:32:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/573d412ce45c594b199cf5144c4998dbe91d0a067c2ad02738da48a91fd3131b"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"780116c7f06975ab13d29bf9acde6677f4afa89788f26856c055f24323a4fb7d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff79f807eae6a13233651edf0b2b0f576c7873223ed4ba7187c2dc05da4cace5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/780116c7f06975ab13d29bf9acde6677f4afa89788f26856c055f24323a4fb7d"}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff79f807eae6a13233651edf0b2b0f576c7873223ed4ba7187c2dc05da4cace5"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9850d1e0843ed114116db8f01ec3d242a1a45affee2abf74a9b21abb8c57decf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9850d1e0843ed114116db8f01ec3d242a1a45affee2abf74a9b21abb8c57decf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81e9f6c88236d409f9b60399509d81dc13f6743a611d6bc98483f7fb6f3f56a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9850d1e0843ed114116db8f01ec3d242a1a45affee2abf74a9b21abb8c57decf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9850d1e0843ed114116db8f01ec3d242a1a45affee2abf74a9b21abb8c57decf"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9850d1e0843ed114116db8f01ec3d242a1a45affee2abf74a9b21abb8c57decf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9850d1e0843ed114116db8f01ec3d242a1a45affee2abf74a9b21abb8c57decf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9850d1e0843ed114116db8f01ec3d242a1a45affee2abf74a9b21abb8c57decf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9850d1e0843ed114116db8f01ec3d242a1a45affee2abf74a9b21abb8c57decf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702"}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81e9f6c88236d409f9b60399509d81dc13f6743a611d6bc98483f7fb6f3f56a5"}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9850d1e0843ed114116db8f01ec3d242a1a45affee2abf74a9b21abb8c57decf"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"943e395b7778b0ec20ceffa7e5833a070f2251dbc1898735c4a64cbee4b71750","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/943e395b7778b0ec20ceffa7e5833a070f2251dbc1898735c4a64cbee4b71750"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6413bd42d410099454bdbbc85f82af4e8917c1fbe5dec2b6a64e52b1b040b5ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cf80bb685a388bca3b8cd29f74c888a167be23d9ac82c01137fd13b44b5d6fbe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6413bd42d410099454bdbbc85f82af4e8917c1fbe5dec2b6a64e52b1b040b5ce"}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510"}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-14T20:32:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cf80bb685a388bca3b8cd29f74c888a167be23d9ac82c01137fd13b44b5d6fbe"}
{"level":"error","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a57eb2228c631c3b0ba7412333a91784bb0ec8d46efc736ee7c85b5656aa2ebe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb04fc3da85a8b77e241b5f969f6c99a3d834a34beade807735c61201da54ff7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"689ec9f4063d6a85b0af8a012a4f80f679ed52bbf7077c0afb50a793bacbb4eb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e722fa04c946dcf1e51aa516c7ab63e2495a853157e7812b458b1a745a82d30a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a57eb2228c631c3b0ba7412333a91784bb0ec8d46efc736ee7c85b5656aa2ebe"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2436a5de33b9b13c2b44fb7ee3b30f2bce393ba95b19f451cd762f38ef84edd4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb04fc3da85a8b77e241b5f969f6c99a3d834a34beade807735c61201da54ff7"}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/689ec9f4063d6a85b0af8a012a4f80f679ed52bbf7077c0afb50a793bacbb4eb"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"22073f9dc55a8d53939b72aba7c808c1c051f873a341e4abbe7db7453dc34778","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"857dd0206095210adec4e2fc77d876a3d7158cab333b9c68d9bca274d08b636f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e722fa04c946dcf1e51aa516c7ab63e2495a853157e7812b458b1a745a82d30a"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef13629378ba0c1b7b8b3fd7f12ae80438dba75b13bdcc3ba30edb8b0b2e7bea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2436a5de33b9b13c2b44fb7ee3b30f2bce393ba95b19f451cd762f38ef84edd4"}
{"level":"debug","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ababf244b02e1aab51519531ab12cc92ce09bb5acf342002d521204f7298d0b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/22073f9dc55a8d53939b72aba7c808c1c051f873a341e4abbe7db7453dc34778"}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/857dd0206095210adec4e2fc77d876a3d7158cab333b9c68d9bca274d08b636f"}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef13629378ba0c1b7b8b3fd7f12ae80438dba75b13bdcc3ba30edb8b0b2e7bea"}
{"level":"info","ts":"2026-07-14T20:32:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ababf244b02e1aab51519531ab12cc92ce09bb5acf342002d521204f7298d0b"}
{"level":"info","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37242","PortSpecifier":{"PortValue":37242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37242","PortSpecifier":{"PortValue":37242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061168,"nanos":437636871},"http":{"id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5f7ca290-3c33-449a-8f0a-9307de540c3b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d3baa49a-68d3-48b6-92d6-f5046695932f"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4984d2c90a66"]}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4984d2c90a66"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d3baa49a-68d3-48b6-92d6-f5046695932f"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5f7ca290-3c33-449a-8f0a-9307de540c3b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b467ce72-c091-4a18-bb7f-1ae300d7fc28","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37436","PortSpecifier":{"PortValue":37436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d04b66.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37436","PortSpecifier":{"PortValue":37436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061168,"nanos":477736874},"http":{"id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","method":"POST","headers":{":authority":"e2e-shared-b-d04b66.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5f7ca290-3c33-449a-8f0a-9307de540c3b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d3baa49a-68d3-48b6-92d6-f5046695932f"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4984d2c90a66"]}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4984d2c90a66"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d3baa49a-68d3-48b6-92d6-f5046695932f"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5f7ca290-3c33-449a-8f0a-9307de540c3b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d04b66.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d04b66/rate-test-model-d04b66\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-d04b66/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4760a212-2e4e-4141-abd0-5fd53c68d5df","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37248","PortSpecifier":{"PortValue":37248}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","method":"POST","path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37248","PortSpecifier":{"PortValue":37248}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061168,"nanos":515916622},"http":{"id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-A0jBG99UI6zRaRBu_jdh1nNgPDdbWh1i27yh5ngbDZ2ge3XhBiqR6AT9SMSv"}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-A0jBG99UI6zRaRBu_jdh1nNgPDdbWh1i27yh5ngbDZ2ge3XhBiqR6AT9SMSv\"}"}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e9a1619c-d1dd-4fee-a006-bd340b704df1","keyName":"e2e-rate-a-8ee9ae","subscription":"e2e-rate-iso-a-8ee9ae","tenant":"e2e-shared-a-10ef4d","userId":"e9a1619c-d1dd-4fee-a006-bd340b704df1","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\",\"requestedSubscription\":\"e2e-rate-iso-a-8ee9ae\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ee9ae","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ee9ae"}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e9a1619c-d1dd-4fee-a006-bd340b704df1","keyName":"e2e-rate-a-8ee9ae","selected_subscription":"e2e-rate-iso-a-8ee9ae","selected_subscription_key":"ai-tenant-e2e-shared-a-10ef4d/e2e-rate-iso-a-8ee9ae@ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ee9ae","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:32:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16f3fcb9-9da6-4fbf-86e2-17955b9bb168","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37256","PortSpecifier":{"PortValue":37256}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1088e837-bec9-42bf-a0ca-81e11079e942","method":"POST","path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37256","PortSpecifier":{"PortValue":37256}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061169,"nanos":576189871},"http":{"id":"1088e837-bec9-42bf-a0ca-81e11079e942","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-A0jBG99UI6zRaRBu_jdh1nNgPDdbWh1i27yh5ngbDZ2ge3XhBiqR6AT9SMSv"}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-A0jBG99UI6zRaRBu_jdh1nNgPDdbWh1i27yh5ngbDZ2ge3XhBiqR6AT9SMSv\"}"}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e9a1619c-d1dd-4fee-a006-bd340b704df1","keyName":"e2e-rate-a-8ee9ae","subscription":"e2e-rate-iso-a-8ee9ae","tenant":"e2e-shared-a-10ef4d","userId":"e9a1619c-d1dd-4fee-a006-bd340b704df1","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\",\"requestedSubscription\":\"e2e-rate-iso-a-8ee9ae\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ee9ae","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ee9ae"}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e9a1619c-d1dd-4fee-a006-bd340b704df1","keyName":"e2e-rate-a-8ee9ae","selected_subscription":"e2e-rate-iso-a-8ee9ae","selected_subscription_key":"ai-tenant-e2e-shared-a-10ef4d/e2e-rate-iso-a-8ee9ae@ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ee9ae","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:32:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1088e837-bec9-42bf-a0ca-81e11079e942","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37258","PortSpecifier":{"PortValue":37258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b5eea939-3f8d-486e-b865-a1337928cafe","method":"POST","path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37258","PortSpecifier":{"PortValue":37258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061170,"nanos":622231391},"http":{"id":"b5eea939-3f8d-486e-b865-a1337928cafe","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-A0jBG99UI6zRaRBu_jdh1nNgPDdbWh1i27yh5ngbDZ2ge3XhBiqR6AT9SMSv"}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-A0jBG99UI6zRaRBu_jdh1nNgPDdbWh1i27yh5ngbDZ2ge3XhBiqR6AT9SMSv\"}"}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e9a1619c-d1dd-4fee-a006-bd340b704df1","keyName":"e2e-rate-a-8ee9ae","subscription":"e2e-rate-iso-a-8ee9ae","tenant":"e2e-shared-a-10ef4d","userId":"e9a1619c-d1dd-4fee-a006-bd340b704df1","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\",\"requestedSubscription\":\"e2e-rate-iso-a-8ee9ae\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ee9ae","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ee9ae"}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e9a1619c-d1dd-4fee-a006-bd340b704df1","keyName":"e2e-rate-a-8ee9ae","selected_subscription":"e2e-rate-iso-a-8ee9ae","selected_subscription_key":"ai-tenant-e2e-shared-a-10ef4d/e2e-rate-iso-a-8ee9ae@ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ee9ae","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:32:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5eea939-3f8d-486e-b865-a1337928cafe","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34730","PortSpecifier":{"PortValue":34730}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34730","PortSpecifier":{"PortValue":34730}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061177,"nanos":518745068},"http":{"id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5f7ca290-3c33-449a-8f0a-9307de540c3b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d3baa49a-68d3-48b6-92d6-f5046695932f"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4984d2c90a66"]}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4984d2c90a66"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d3baa49a-68d3-48b6-92d6-f5046695932f"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5f7ca290-3c33-449a-8f0a-9307de540c3b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97e302b7-dd1f-419d-afff-a891b7afb7a0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f79f2193-7028-41ee-9c4f-084f88bc131d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34268","PortSpecifier":{"PortValue":34268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f79f2193-7028-41ee-9c4f-084f88bc131d","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d04b66.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f79f2193-7028-41ee-9c4f-084f88bc131d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34268","PortSpecifier":{"PortValue":34268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061177,"nanos":554946251},"http":{"id":"f79f2193-7028-41ee-9c4f-084f88bc131d","method":"POST","headers":{":authority":"e2e-shared-b-d04b66.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f79f2193-7028-41ee-9c4f-084f88bc131d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f79f2193-7028-41ee-9c4f-084f88bc131d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5f7ca290-3c33-449a-8f0a-9307de540c3b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d3baa49a-68d3-48b6-92d6-f5046695932f"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4984d2c90a66"]}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f79f2193-7028-41ee-9c4f-084f88bc131d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4984d2c90a66"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d3baa49a-68d3-48b6-92d6-f5046695932f"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5f7ca290-3c33-449a-8f0a-9307de540c3b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d04b66.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f79f2193-7028-41ee-9c4f-084f88bc131d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f79f2193-7028-41ee-9c4f-084f88bc131d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f79f2193-7028-41ee-9c4f-084f88bc131d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d04b66/rate-test-model-d04b66\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-d04b66/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f79f2193-7028-41ee-9c4f-084f88bc131d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f79f2193-7028-41ee-9c4f-084f88bc131d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f79f2193-7028-41ee-9c4f-084f88bc131d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f79f2193-7028-41ee-9c4f-084f88bc131d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f79f2193-7028-41ee-9c4f-084f88bc131d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34746","PortSpecifier":{"PortValue":34746}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","method":"POST","path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34746","PortSpecifier":{"PortValue":34746}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061177,"nanos":590160740},"http":{"id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF"}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF\"}"}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","subscription":"e2e-rate-iso-a-5085f8","tenant":"e2e-shared-a-10ef4d","userId":"8b220532-69d5-4315-9332-890ef625776a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\",\"requestedSubscription\":\"e2e-rate-iso-a-5085f8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5085f8"}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","selected_subscription":"e2e-rate-iso-a-5085f8","selected_subscription_key":"ai-tenant-e2e-shared-a-10ef4d/e2e-rate-iso-a-5085f8@ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:32:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1919c1b7-6167-474a-bfa6-fde64ded2fa5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34750","PortSpecifier":{"PortValue":34750}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","method":"POST","path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34750","PortSpecifier":{"PortValue":34750}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061178,"nanos":628868767},"http":{"id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF"}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF\"}"}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","subscription":"e2e-rate-iso-a-5085f8","tenant":"e2e-shared-a-10ef4d","userId":"8b220532-69d5-4315-9332-890ef625776a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\",\"requestedSubscription\":\"e2e-rate-iso-a-5085f8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5085f8"}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","selected_subscription":"e2e-rate-iso-a-5085f8","selected_subscription_key":"ai-tenant-e2e-shared-a-10ef4d/e2e-rate-iso-a-5085f8@ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:32:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0e095871-1673-42c7-9f3e-afd6015cdf6a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34764","PortSpecifier":{"PortValue":34764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"44dd476c-2844-4ad7-8537-6314560f8ec1","method":"POST","path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34764","PortSpecifier":{"PortValue":34764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061179,"nanos":669694886},"http":{"id":"44dd476c-2844-4ad7-8537-6314560f8ec1","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF"}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF\"}"}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","subscription":"e2e-rate-iso-a-5085f8","tenant":"e2e-shared-a-10ef4d","userId":"8b220532-69d5-4315-9332-890ef625776a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\",\"requestedSubscription\":\"e2e-rate-iso-a-5085f8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5085f8"}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","selected_subscription":"e2e-rate-iso-a-5085f8","selected_subscription_key":"ai-tenant-e2e-shared-a-10ef4d/e2e-rate-iso-a-5085f8@ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:32:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44dd476c-2844-4ad7-8537-6314560f8ec1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34774","PortSpecifier":{"PortValue":34774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"31441c00-fa89-454f-a1ac-74fbda4415ce","method":"POST","path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34774","PortSpecifier":{"PortValue":34774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061180,"nanos":708108627},"http":{"id":"31441c00-fa89-454f-a1ac-74fbda4415ce","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF"}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF\"}"}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","subscription":"e2e-rate-iso-a-5085f8","tenant":"e2e-shared-a-10ef4d","userId":"8b220532-69d5-4315-9332-890ef625776a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\",\"requestedSubscription\":\"e2e-rate-iso-a-5085f8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5085f8"}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","selected_subscription":"e2e-rate-iso-a-5085f8","selected_subscription_key":"ai-tenant-e2e-shared-a-10ef4d/e2e-rate-iso-a-5085f8@ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:33:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31441c00-fa89-454f-a1ac-74fbda4415ce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34784","PortSpecifier":{"PortValue":34784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","method":"POST","path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34784","PortSpecifier":{"PortValue":34784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061181,"nanos":748168013},"http":{"id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF"}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF\"}"}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","subscription":"e2e-rate-iso-a-5085f8","tenant":"e2e-shared-a-10ef4d","userId":"8b220532-69d5-4315-9332-890ef625776a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\",\"requestedSubscription\":\"e2e-rate-iso-a-5085f8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5085f8"}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","selected_subscription":"e2e-rate-iso-a-5085f8","selected_subscription_key":"ai-tenant-e2e-shared-a-10ef4d/e2e-rate-iso-a-5085f8@ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:33:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4840ecca-b33d-4ca3-a167-7bc1fbeae145","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34800","PortSpecifier":{"PortValue":34800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","method":"POST","path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34800","PortSpecifier":{"PortValue":34800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061182,"nanos":787407703},"http":{"id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF"}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF\"}"}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","subscription":"e2e-rate-iso-a-5085f8","tenant":"e2e-shared-a-10ef4d","userId":"8b220532-69d5-4315-9332-890ef625776a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\",\"requestedSubscription\":\"e2e-rate-iso-a-5085f8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5085f8"}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","selected_subscription":"e2e-rate-iso-a-5085f8","selected_subscription_key":"ai-tenant-e2e-shared-a-10ef4d/e2e-rate-iso-a-5085f8@ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:33:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7757c2b4-7d1a-4d86-9d19-06718c0b3a9b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34808","PortSpecifier":{"PortValue":34808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","method":"POST","path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34808","PortSpecifier":{"PortValue":34808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061183,"nanos":827826742},"http":{"id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF"}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF\"}"}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","subscription":"e2e-rate-iso-a-5085f8","tenant":"e2e-shared-a-10ef4d","userId":"8b220532-69d5-4315-9332-890ef625776a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\",\"requestedSubscription\":\"e2e-rate-iso-a-5085f8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5085f8"}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","selected_subscription":"e2e-rate-iso-a-5085f8","selected_subscription_key":"ai-tenant-e2e-shared-a-10ef4d/e2e-rate-iso-a-5085f8@ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:33:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31d9fff6-9b7f-40fe-a5f7-ccecb0170cb4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:48934","PortSpecifier":{"PortValue":48934}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","method":"POST","path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:48934","PortSpecifier":{"PortValue":48934}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061184,"nanos":862259797},"http":{"id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF"}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF\"}"}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","subscription":"e2e-rate-iso-a-5085f8","tenant":"e2e-shared-a-10ef4d","userId":"8b220532-69d5-4315-9332-890ef625776a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\",\"requestedSubscription\":\"e2e-rate-iso-a-5085f8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5085f8"}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","selected_subscription":"e2e-rate-iso-a-5085f8","selected_subscription_key":"ai-tenant-e2e-shared-a-10ef4d/e2e-rate-iso-a-5085f8@ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:33:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab49d3c2-7227-4a27-90fa-84c0890be46c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:48936","PortSpecifier":{"PortValue":48936}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","method":"POST","path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:48936","PortSpecifier":{"PortValue":48936}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061185,"nanos":896721299},"http":{"id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF"}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF\"}"}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","subscription":"e2e-rate-iso-a-5085f8","tenant":"e2e-shared-a-10ef4d","userId":"8b220532-69d5-4315-9332-890ef625776a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\",\"requestedSubscription\":\"e2e-rate-iso-a-5085f8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5085f8"}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","selected_subscription":"e2e-rate-iso-a-5085f8","selected_subscription_key":"ai-tenant-e2e-shared-a-10ef4d/e2e-rate-iso-a-5085f8@ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:33:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a0a9c73-790d-4075-bf46-8a60cd652cb7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:48940","PortSpecifier":{"PortValue":48940}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","method":"POST","path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions","host":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:48940","PortSpecifier":{"PortValue":48940}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061186,"nanos":935568385},"http":{"id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","method":"POST","headers":{":authority":"e2e-shared-a-10ef4d.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6ygrYTQpqqvF7Xkb_Xv54t4WzfyPpb63F7pPJv5XwwuYSyPr5awOBKfSrZwF\"}"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","subscription":"e2e-rate-iso-a-5085f8","tenant":"e2e-shared-a-10ef4d","userId":"8b220532-69d5-4315-9332-890ef625776a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\",\"requestedSubscription\":\"e2e-rate-iso-a-5085f8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-10ef4d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-10ef4d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5085f8"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8b220532-69d5-4315-9332-890ef625776a","keyName":"e2e-rate-a-5085f8","selected_subscription":"e2e-rate-iso-a-5085f8","selected_subscription_key":"ai-tenant-e2e-shared-a-10ef4d/e2e-rate-iso-a-5085f8@ai-tenant-e2e-shared-a-10ef4d/rate-test-model-10ef4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-10ef4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5085f8","namespace":"ai-tenant-e2e-shared-a-10ef4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"768bebfa-5cfc-4362-aa51-51aa66ad74f9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35194","PortSpecifier":{"PortValue":35194}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c715ea51-2626-48f2-9ad9-e2fa88147438","method":"POST","path":"/ai-tenant-e2e-shared-b-d04b66/rate-test-model-d04b66/v1/completions","host":"e2e-shared-b-d04b66.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:35194","PortSpecifier":{"PortValue":35194}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784061186,"nanos":970121561},"http":{"id":"c715ea51-2626-48f2-9ad9-e2fa88147438","method":"POST","headers":{":authority":"e2e-shared-b-d04b66.apps.126eb6ca-52e4-421a-ae93-4984d2c90a66.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-d04b66/rate-test-model-d04b66/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2qSah8YG6oWlFfwP_eFDHO15OQy3ZfsF27UziiQeY1MmYZtDOJ2fQYkLMlFX"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d04b66.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2qSah8YG6oWlFfwP_eFDHO15OQy3ZfsF27UziiQeY1MmYZtDOJ2fQYkLMlFX\"}"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d04b66.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0dfdee48-0d81-4d6b-8d07-6d4d0dde21e3","keyName":"e2e-rate-b-5085f8","subscription":"e2e-rate-iso-b-5085f8","tenant":"e2e-shared-b-d04b66","userId":"0dfdee48-0d81-4d6b-8d07-6d4d0dde21e3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-d04b66.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-d04b66/rate-test-model-d04b66\",\"requestedSubscription\":\"e2e-rate-iso-b-5085f8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d04b66.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d04b66","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-5085f8","namespace":"ai-tenant-e2e-shared-b-d04b66","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d04b66/rate-test-model-d04b66\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-d04b66/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-5085f8"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0dfdee48-0d81-4d6b-8d07-6d4d0dde21e3","keyName":"e2e-rate-b-5085f8","selected_subscription":"e2e-rate-iso-b-5085f8","selected_subscription_key":"ai-tenant-e2e-shared-b-d04b66/e2e-rate-iso-b-5085f8@ai-tenant-e2e-shared-b-d04b66/rate-test-model-d04b66","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d04b66","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-5085f8","namespace":"ai-tenant-e2e-shared-b-d04b66","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-14T20:33:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c715ea51-2626-48f2-9ad9-e2fa88147438","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-14T20:33:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ef13629378ba0c1b7b8b3fd7f12ae80438dba75b13bdcc3ba30edb8b0b2e7bea"}
{"level":"info","ts":"2026-07-14T20:33:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee4ee24ea6c385cdd46d741fa0c1a8c7d2569c9ea3c74aa6143e27a813f9805b"}
{"level":"info","ts":"2026-07-14T20:33:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ff79f807eae6a13233651edf0b2b0f576c7873223ed4ba7187c2dc05da4cace5"}
{"level":"info","ts":"2026-07-14T20:33:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cf80bb685a388bca3b8cd29f74c888a167be23d9ac82c01137fd13b44b5d6fbe"}
{"level":"info","ts":"2026-07-14T20:33:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/857dd0206095210adec4e2fc77d876a3d7158cab333b9c68d9bca274d08b636f"}
{"level":"info","ts":"2026-07-14T20:33:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6b8da889b2da09bb8714325a0723d4edfa374097693680e289958ecaff408626"}
{"level":"info","ts":"2026-07-14T20:33:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/826b10ce7bf13a80bf12d7824bbebd76c76227b2d5fff66e6df08856ef86d22c"}
{"level":"info","ts":"2026-07-14T20:33:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e722fa04c946dcf1e51aa516c7ab63e2495a853157e7812b458b1a745a82d30a"}
{"level":"info","ts":"2026-07-14T20:33:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4ababf244b02e1aab51519531ab12cc92ce09bb5acf342002d521204f7298d0b"}
{"level":"info","ts":"2026-07-14T20:33:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/943e395b7778b0ec20ceffa7e5833a070f2251dbc1898735c4a64cbee4b71750"}
{"level":"info","ts":"2026-07-14T20:33:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/689ec9f4063d6a85b0af8a012a4f80f679ed52bbf7077c0afb50a793bacbb4eb"}
{"level":"info","ts":"2026-07-14T20:33:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a57eb2228c631c3b0ba7412333a91784bb0ec8d46efc736ee7c85b5656aa2ebe"}
{"level":"info","ts":"2026-07-14T20:33:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/403dc7361e8b5d4945eeac921cd0bfdb9f9278b81d3cad94789169aca7e85510"}
{"level":"info","ts":"2026-07-14T20:33:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/780116c7f06975ab13d29bf9acde6677f4afa89788f26856c055f24323a4fb7d"}
{"level":"info","ts":"2026-07-14T20:33:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6413bd42d410099454bdbbc85f82af4e8917c1fbe5dec2b6a64e52b1b040b5ce"}
{"level":"info","ts":"2026-07-14T20:33:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eb04fc3da85a8b77e241b5f969f6c99a3d834a34beade807735c61201da54ff7"}
{"level":"info","ts":"2026-07-14T20:33:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/573d412ce45c594b199cf5144c4998dbe91d0a067c2ad02738da48a91fd3131b"}
{"level":"info","ts":"2026-07-14T20:33:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/858d4c3fbcb0d7f004c14478b5b1a0e63988dade7db601148b20e6d22dc4f85a"}
{"level":"info","ts":"2026-07-14T20:33:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/22073f9dc55a8d53939b72aba7c808c1c051f873a341e4abbe7db7453dc34778"}
{"level":"info","ts":"2026-07-14T20:33:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3fc44afc2a7ff1514180d31c2dadefd9069875665182914b7c1ae2554fab15ce"}
{"level":"info","ts":"2026-07-14T20:34:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9850d1e0843ed114116db8f01ec3d242a1a45affee2abf74a9b21abb8c57decf"}
{"level":"info","ts":"2026-07-14T20:34:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2436a5de33b9b13c2b44fb7ee3b30f2bce393ba95b19f451cd762f38ef84edd4"}
{"level":"info","ts":"2026-07-14T20:34:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/81e9f6c88236d409f9b60399509d81dc13f6743a611d6bc98483f7fb6f3f56a5"}
{"level":"info","ts":"2026-07-14T20:34:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0727488f9197e1b384591fd8760a2212d9871f2ff35b02532180b836cdd0f702"}