--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"info","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"14211ef52b9b9a3fdddc9138849618c0df142fd65820ce7a9c3700bbee0014a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"14211ef52b9b9a3fdddc9138849618c0df142fd65820ce7a9c3700bbee0014a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"14211ef52b9b9a3fdddc9138849618c0df142fd65820ce7a9c3700bbee0014a6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/14211ef52b9b9a3fdddc9138849618c0df142fd65820ce7a9c3700bbee0014a6"}
{"level":"debug","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"14211ef52b9b9a3fdddc9138849618c0df142fd65820ce7a9c3700bbee0014a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["14211ef52b9b9a3fdddc9138849618c0df142fd65820ce7a9c3700bbee0014a6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"14211ef52b9b9a3fdddc9138849618c0df142fd65820ce7a9c3700bbee0014a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"14211ef52b9b9a3fdddc9138849618c0df142fd65820ce7a9c3700bbee0014a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/14211ef52b9b9a3fdddc9138849618c0df142fd65820ce7a9c3700bbee0014a6"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace"}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"}
{"level":"error","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2033d2b8386508be0358068da6a39962c3343996ae262f9abf82494d43e85fa6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2033d2b8386508be0358068da6a39962c3343996ae262f9abf82494d43e85fa6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2033d2b8386508be0358068da6a39962c3343996ae262f9abf82494d43e85fa6"}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2033d2b8386508be0358068da6a39962c3343996ae262f9abf82494d43e85fa6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2033d2b8386508be0358068da6a39962c3343996ae262f9abf82494d43e85fa6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2033d2b8386508be0358068da6a39962c3343996ae262f9abf82494d43e85fa6"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2033d2b8386508be0358068da6a39962c3343996ae262f9abf82494d43e85fa6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2033d2b8386508be0358068da6a39962c3343996ae262f9abf82494d43e85fa6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2033d2b8386508be0358068da6a39962c3343996ae262f9abf82494d43e85fa6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2033d2b8386508be0358068da6a39962c3343996ae262f9abf82494d43e85fa6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2033d2b8386508be0358068da6a39962c3343996ae262f9abf82494d43e85fa6"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6d9ab9a58e69ea17a260ae3f67eefcc8ea6708072d4c3ea8c546c9a7f47f06aa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d"}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6d9ab9a58e69ea17a260ae3f67eefcc8ea6708072d4c3ea8c546c9a7f47f06aa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6d9ab9a58e69ea17a260ae3f67eefcc8ea6708072d4c3ea8c546c9a7f47f06aa"}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6d9ab9a58e69ea17a260ae3f67eefcc8ea6708072d4c3ea8c546c9a7f47f06aa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6d9ab9a58e69ea17a260ae3f67eefcc8ea6708072d4c3ea8c546c9a7f47f06aa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6d9ab9a58e69ea17a260ae3f67eefcc8ea6708072d4c3ea8c546c9a7f47f06aa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf"}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6d9ab9a58e69ea17a260ae3f67eefcc8ea6708072d4c3ea8c546c9a7f47f06aa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d"}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6d9ab9a58e69ea17a260ae3f67eefcc8ea6708072d4c3ea8c546c9a7f47f06aa"}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b"}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"}
{"level":"debug","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"}
{"level":"debug","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"}
{"level":"debug","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"}
{"level":"debug","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:07:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:07:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"}
{"level":"debug","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"}
{"level":"debug","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:07:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:07:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:07:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"}
{"level":"info","ts":"2026-07-10T15:07:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"edfea6c4-d16f-4ac7-bd6a-577075862060","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:53412","PortSpecifier":{"PortValue":53412}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"edfea6c4-d16f-4ac7-bd6a-577075862060","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:07:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"edfea6c4-d16f-4ac7-bd6a-577075862060","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:53412","PortSpecifier":{"PortValue":53412}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696044,"nanos":937444643},"http":{"id":"edfea6c4-d16f-4ac7-bd6a-577075862060","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"edfea6c4-d16f-4ac7-bd6a-577075862060","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:07:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"edfea6c4-d16f-4ac7-bd6a-577075862060","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:07:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"edfea6c4-d16f-4ac7-bd6a-577075862060","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edfea6c4-d16f-4ac7-bd6a-577075862060","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edfea6c4-d16f-4ac7-bd6a-577075862060","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edfea6c4-d16f-4ac7-bd6a-577075862060","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/auth-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"edfea6c4-d16f-4ac7-bd6a-577075862060","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:07:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edfea6c4-d16f-4ac7-bd6a-577075862060","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:07:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edfea6c4-d16f-4ac7-bd6a-577075862060","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:07:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"edfea6c4-d16f-4ac7-bd6a-577075862060","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:07:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"edfea6c4-d16f-4ac7-bd6a-577075862060","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d0f995c-0693-4ec1-b018-fd597de248a3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:36640","PortSpecifier":{"PortValue":36640}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5d0f995c-0693-4ec1-b018-fd597de248a3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d0f995c-0693-4ec1-b018-fd597de248a3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:36640","PortSpecifier":{"PortValue":36640}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696045,"nanos":3474948},"http":{"id":"5d0f995c-0693-4ec1-b018-fd597de248a3","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5d0f995c-0693-4ec1-b018-fd597de248a3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5d0f995c-0693-4ec1-b018-fd597de248a3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5d0f995c-0693-4ec1-b018-fd597de248a3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d0f995c-0693-4ec1-b018-fd597de248a3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d0f995c-0693-4ec1-b018-fd597de248a3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d0f995c-0693-4ec1-b018-fd597de248a3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/auth-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5d0f995c-0693-4ec1-b018-fd597de248a3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d0f995c-0693-4ec1-b018-fd597de248a3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d0f995c-0693-4ec1-b018-fd597de248a3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d0f995c-0693-4ec1-b018-fd597de248a3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d0f995c-0693-4ec1-b018-fd597de248a3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:53420","PortSpecifier":{"PortValue":53420}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","method":"GET","path":"/maas-api/v1/api-keys/9594cdc7-535c-410a-8587-2ed74ce4398a","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:53420","PortSpecifier":{"PortValue":53420}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696045,"nanos":65057389},"http":{"id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","method":"GET","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/9594cdc7-535c-410a-8587-2ed74ce4398a",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/9594cdc7-535c-410a-8587-2ed74ce4398a",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/auth-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7600a2e-709e-48f3-a5d0-91c7da666e74","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:36656","PortSpecifier":{"PortValue":36656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","method":"GET","path":"/maas-api/v1/api-keys/ba7927e1-f7d5-4557-bd77-d28a4214a79e","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:36656","PortSpecifier":{"PortValue":36656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696045,"nanos":103575938},"http":{"id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","method":"GET","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/ba7927e1-f7d5-4557-bd77-d28a4214a79e",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/ba7927e1-f7d5-4557-bd77-d28a4214a79e",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/auth-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:07:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9805b30-fc91-4e5d-89fe-8a87ae2b9716","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:56804","PortSpecifier":{"PortValue":56804}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:56804","PortSpecifier":{"PortValue":56804}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696060,"nanos":310134917},"http":{"id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/auth-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84c18d02-c147-4d38-96cb-f3cb4fd615af","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55338","PortSpecifier":{"PortValue":55338}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55338","PortSpecifier":{"PortValue":55338}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696060,"nanos":347833183},"http":{"id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/auth-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95f74f3a-621d-4ce5-89d9-60b677789dd9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2395b4e-4480-4550-809e-b9368c76392a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:56810","PortSpecifier":{"PortValue":56810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d2395b4e-4480-4550-809e-b9368c76392a","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2395b4e-4480-4550-809e-b9368c76392a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:56810","PortSpecifier":{"PortValue":56810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696060,"nanos":387624873},"http":{"id":"d2395b4e-4480-4550-809e-b9368c76392a","method":"GET","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d2395b4e-4480-4550-809e-b9368c76392a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-HeHTuTLCrtCV0NJI_OkWtcBUHyI37m9HnZhndF1yhJKMbUIs57y7n3Gflqst"}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d2395b4e-4480-4550-809e-b9368c76392a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-HeHTuTLCrtCV0NJI_OkWtcBUHyI37m9HnZhndF1yhJKMbUIs57y7n3Gflqst\"}"}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d2395b4e-4480-4550-809e-b9368c76392a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"75607b85-9fea-4409-9493-2df9d8395ec6","keyName":"e2e-auth-iso-a-bd9f8b","subscription":"e2e-auth-iso-7dc71d","tenant":"e2e-shared-a-1f1c9a","userId":"75607b85-9fea-4409-9493-2df9d8395ec6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d2395b4e-4480-4550-809e-b9368c76392a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2395b4e-4480-4550-809e-b9368c76392a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2395b4e-4480-4550-809e-b9368c76392a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2395b4e-4480-4550-809e-b9368c76392a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/auth-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d2395b4e-4480-4550-809e-b9368c76392a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2395b4e-4480-4550-809e-b9368c76392a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2395b4e-4480-4550-809e-b9368c76392a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-7dc71d"}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2395b4e-4480-4550-809e-b9368c76392a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2395b4e-4480-4550-809e-b9368c76392a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:07:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2395b4e-4480-4550-809e-b9368c76392a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44756","PortSpecifier":{"PortValue":44756}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44756","PortSpecifier":{"PortValue":44756}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696075,"nanos":641819557},"http":{"id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/auth-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b9dd357-1744-47d4-8a27-be8be439ea2c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"55aea114-4372-459c-a4f5-47251f2ce959","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:41936","PortSpecifier":{"PortValue":41936}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"55aea114-4372-459c-a4f5-47251f2ce959","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"55aea114-4372-459c-a4f5-47251f2ce959","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:41936","PortSpecifier":{"PortValue":41936}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696075,"nanos":682028016},"http":{"id":"55aea114-4372-459c-a4f5-47251f2ce959","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"55aea114-4372-459c-a4f5-47251f2ce959","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"55aea114-4372-459c-a4f5-47251f2ce959","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"55aea114-4372-459c-a4f5-47251f2ce959","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"55aea114-4372-459c-a4f5-47251f2ce959","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"55aea114-4372-459c-a4f5-47251f2ce959","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"55aea114-4372-459c-a4f5-47251f2ce959","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/auth-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"55aea114-4372-459c-a4f5-47251f2ce959","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"55aea114-4372-459c-a4f5-47251f2ce959","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"55aea114-4372-459c-a4f5-47251f2ce959","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"55aea114-4372-459c-a4f5-47251f2ce959","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"55aea114-4372-459c-a4f5-47251f2ce959","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84199717-df30-4643-a0ca-5965168ac3fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:41946","PortSpecifier":{"PortValue":41946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"84199717-df30-4643-a0ca-5965168ac3fb","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84199717-df30-4643-a0ca-5965168ac3fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:41946","PortSpecifier":{"PortValue":41946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696075,"nanos":723815654},"http":{"id":"84199717-df30-4643-a0ca-5965168ac3fb","method":"GET","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"84199717-df30-4643-a0ca-5965168ac3fb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-SS7ZO8DyhlkHwQ11_FhxjguvbpImpoe5Rw6q0mOs4YuGlYNmrGdumDIHCdxI"}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84199717-df30-4643-a0ca-5965168ac3fb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-SS7ZO8DyhlkHwQ11_FhxjguvbpImpoe5Rw6q0mOs4YuGlYNmrGdumDIHCdxI\"}"}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84199717-df30-4643-a0ca-5965168ac3fb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key not found","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"84199717-df30-4643-a0ca-5965168ac3fb","input":{"auth":{"identity":"Bearer **** not found","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84199717-df30-4643-a0ca-5965168ac3fb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"84199717-df30-4643-a0ca-5965168ac3fb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84199717-df30-4643-a0ca-5965168ac3fb","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-10T15:07:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84199717-df30-4643-a0ca-5965168ac3fb","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:36620","PortSpecifier":{"PortValue":36620}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:36620","PortSpecifier":{"PortValue":36620}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696090,"nanos":944548721},"http":{"id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/auth-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a39fc96-8627-499f-bdfd-ec1e103e9cfa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"210f4518-7193-470f-a991-3cb0fe067187","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:47094","PortSpecifier":{"PortValue":47094}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"210f4518-7193-470f-a991-3cb0fe067187","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"210f4518-7193-470f-a991-3cb0fe067187","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:47094","PortSpecifier":{"PortValue":47094}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696090,"nanos":982575648},"http":{"id":"210f4518-7193-470f-a991-3cb0fe067187","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"210f4518-7193-470f-a991-3cb0fe067187","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"210f4518-7193-470f-a991-3cb0fe067187","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"210f4518-7193-470f-a991-3cb0fe067187","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"210f4518-7193-470f-a991-3cb0fe067187","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"210f4518-7193-470f-a991-3cb0fe067187","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"210f4518-7193-470f-a991-3cb0fe067187","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/auth-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"210f4518-7193-470f-a991-3cb0fe067187","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"210f4518-7193-470f-a991-3cb0fe067187","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"210f4518-7193-470f-a991-3cb0fe067187","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"210f4518-7193-470f-a991-3cb0fe067187","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:08:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"210f4518-7193-470f-a991-3cb0fe067187","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6974fa82-eafb-4989-9de2-fd39717c299e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:36628","PortSpecifier":{"PortValue":36628}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6974fa82-eafb-4989-9de2-fd39717c299e","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6974fa82-eafb-4989-9de2-fd39717c299e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:36628","PortSpecifier":{"PortValue":36628}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696091,"nanos":21180003},"http":{"id":"6974fa82-eafb-4989-9de2-fd39717c299e","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6974fa82-eafb-4989-9de2-fd39717c299e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6974fa82-eafb-4989-9de2-fd39717c299e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6974fa82-eafb-4989-9de2-fd39717c299e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6974fa82-eafb-4989-9de2-fd39717c299e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6974fa82-eafb-4989-9de2-fd39717c299e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6974fa82-eafb-4989-9de2-fd39717c299e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/auth-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6974fa82-eafb-4989-9de2-fd39717c299e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6974fa82-eafb-4989-9de2-fd39717c299e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6974fa82-eafb-4989-9de2-fd39717c299e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6974fa82-eafb-4989-9de2-fd39717c299e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6974fa82-eafb-4989-9de2-fd39717c299e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:47108","PortSpecifier":{"PortValue":47108}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:47108","PortSpecifier":{"PortValue":47108}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696091,"nanos":60316911},"http":{"id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/auth-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:08:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68b7efdc-320e-4fc6-a19c-07af47a1c41a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0e25d8fd-8beb-4895-9626-b75139346b31","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37866","PortSpecifier":{"PortValue":37866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0e25d8fd-8beb-4895-9626-b75139346b31","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0e25d8fd-8beb-4895-9626-b75139346b31","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37866","PortSpecifier":{"PortValue":37866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696106,"nanos":230406119},"http":{"id":"0e25d8fd-8beb-4895-9626-b75139346b31","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0e25d8fd-8beb-4895-9626-b75139346b31","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0e25d8fd-8beb-4895-9626-b75139346b31","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0e25d8fd-8beb-4895-9626-b75139346b31","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e25d8fd-8beb-4895-9626-b75139346b31","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e25d8fd-8beb-4895-9626-b75139346b31","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e25d8fd-8beb-4895-9626-b75139346b31","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/auth-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0e25d8fd-8beb-4895-9626-b75139346b31","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e25d8fd-8beb-4895-9626-b75139346b31","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e25d8fd-8beb-4895-9626-b75139346b31","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0e25d8fd-8beb-4895-9626-b75139346b31","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0e25d8fd-8beb-4895-9626-b75139346b31","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:36812","PortSpecifier":{"PortValue":36812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:36812","PortSpecifier":{"PortValue":36812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696106,"nanos":278321714},"http":{"id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/auth-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b23cfd63-7b93-424a-81f1-5d38c6c04de7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:36822","PortSpecifier":{"PortValue":36822}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","method":"GET","path":"/maas-api/v1/api-keys/7fef9399-3184-4174-9ec0-2e6263f2c9c4","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:36822","PortSpecifier":{"PortValue":36822}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696106,"nanos":312718279},"http":{"id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","method":"GET","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/7fef9399-3184-4174-9ec0-2e6263f2c9c4",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/7fef9399-3184-4174-9ec0-2e6263f2c9c4",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/auth-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b7d506a-f394-4cf6-b708-a0ac4a2f55ae","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73c7c483-8dbf-46c5-a704-73999726a3d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37872","PortSpecifier":{"PortValue":37872}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"73c7c483-8dbf-46c5-a704-73999726a3d0","method":"GET","path":"/maas-api/v1/api-keys/7fef9399-3184-4174-9ec0-2e6263f2c9c4","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73c7c483-8dbf-46c5-a704-73999726a3d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37872","PortSpecifier":{"PortValue":37872}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696106,"nanos":341787262},"http":{"id":"73c7c483-8dbf-46c5-a704-73999726a3d0","method":"GET","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/7fef9399-3184-4174-9ec0-2e6263f2c9c4",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"73c7c483-8dbf-46c5-a704-73999726a3d0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"73c7c483-8dbf-46c5-a704-73999726a3d0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"73c7c483-8dbf-46c5-a704-73999726a3d0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/7fef9399-3184-4174-9ec0-2e6263f2c9c4",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73c7c483-8dbf-46c5-a704-73999726a3d0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73c7c483-8dbf-46c5-a704-73999726a3d0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73c7c483-8dbf-46c5-a704-73999726a3d0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/auth-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"73c7c483-8dbf-46c5-a704-73999726a3d0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73c7c483-8dbf-46c5-a704-73999726a3d0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73c7c483-8dbf-46c5-a704-73999726a3d0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73c7c483-8dbf-46c5-a704-73999726a3d0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:08:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73c7c483-8dbf-46c5-a704-73999726a3d0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:43582","PortSpecifier":{"PortValue":43582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:43582","PortSpecifier":{"PortValue":43582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696123,"nanos":639732152},"http":{"id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/auth-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cdf278e8-3953-4bb5-bb85-2d3e4f2c67f2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f48bb9ac-2910-481a-b364-35697d430c07","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:45658","PortSpecifier":{"PortValue":45658}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f48bb9ac-2910-481a-b364-35697d430c07","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f48bb9ac-2910-481a-b364-35697d430c07","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:45658","PortSpecifier":{"PortValue":45658}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696123,"nanos":676557888},"http":{"id":"f48bb9ac-2910-481a-b364-35697d430c07","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f48bb9ac-2910-481a-b364-35697d430c07","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f48bb9ac-2910-481a-b364-35697d430c07","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f48bb9ac-2910-481a-b364-35697d430c07","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f48bb9ac-2910-481a-b364-35697d430c07","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f48bb9ac-2910-481a-b364-35697d430c07","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f48bb9ac-2910-481a-b364-35697d430c07","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/auth-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f48bb9ac-2910-481a-b364-35697d430c07","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f48bb9ac-2910-481a-b364-35697d430c07","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f48bb9ac-2910-481a-b364-35697d430c07","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f48bb9ac-2910-481a-b364-35697d430c07","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f48bb9ac-2910-481a-b364-35697d430c07","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:43594","PortSpecifier":{"PortValue":43594}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"38e22772-a406-4e63-a3f5-e1a10193ab84","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:43594","PortSpecifier":{"PortValue":43594}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696123,"nanos":710369063},"http":{"id":"38e22772-a406-4e63-a3f5-e1a10193ab84","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-4itRu5H522LyeHuO_IbgVJuIN79ccoT5ZHYhk5zCoqcKOUr6voqGjNqkYEl4"}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-4itRu5H522LyeHuO_IbgVJuIN79ccoT5ZHYhk5zCoqcKOUr6voqGjNqkYEl4\"}"}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"415555ee-80dd-4fbf-afa8-47da9a5468ca","keyName":"e2e-auth-iso-a-2dba43","subscription":"e2e-auth-iso-c338d5","tenant":"e2e-shared-a-1f1c9a","userId":"415555ee-80dd-4fbf-afa8-47da9a5468ca","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/auth-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-c338d5"}
{"level":"info","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:08:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"38e22772-a406-4e63-a3f5-e1a10193ab84","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:08:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b75eb300b11af92379286cb991e178468b3c79892e609f7af470a5c2edc5c8e3"}
{"level":"info","ts":"2026-07-10T15:08:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b88ac74639ca2373e2c91947285a7760938e5a68d84c6dd6cb9d400399400ace"}
{"level":"info","ts":"2026-07-10T15:08:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ae72fa531bfd7a4044cd4b6d060178b46b6a264dab266cc935bed2b5e124523e"}
{"level":"info","ts":"2026-07-10T15:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f890b9beeba4cddaa531ccee6d62933e4a303cd3954d210428c7cde02a88dee9"}
{"level":"info","ts":"2026-07-10T15:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/14211ef52b9b9a3fdddc9138849618c0df142fd65820ce7a9c3700bbee0014a6"}
{"level":"info","ts":"2026-07-10T15:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2033d2b8386508be0358068da6a39962c3343996ae262f9abf82494d43e85fa6"}
{"level":"info","ts":"2026-07-10T15:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/39c54f8bcdce4c8555758b8c0f47f3e5847132e7099be114a5dd1cb93033d933"}
{"level":"info","ts":"2026-07-10T15:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d944f484783459e05b700065cffdf7cd3ad4e6f8845ced550b1e9a1a114a05b1"}
{"level":"info","ts":"2026-07-10T15:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/80e88131e6e719681ae7c8710eb586985ff54765a4bd65c6ea550f791ef69937"}
{"level":"info","ts":"2026-07-10T15:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6d9ab9a58e69ea17a260ae3f67eefcc8ea6708072d4c3ea8c546c9a7f47f06aa"}
{"level":"info","ts":"2026-07-10T15:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/436d6f0873123dd6d307aad445e71fa6b5bbc5fde79a6c56a8d067d8197e9bb1"}
{"level":"info","ts":"2026-07-10T15:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3f8b24f9107afa6f054cdbae5c6a603f290a0858dd2395a771e71bfca1e235bf"}
{"level":"info","ts":"2026-07-10T15:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8e2fc584c9ca726884cb6e24f85ff6c09b838c68de9caddd92ab7aa23710017d"}
{"level":"info","ts":"2026-07-10T15:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e178ca0029e10d13f980098231123224df09a3a857ddb4706b79d6a699654038"}
{"level":"info","ts":"2026-07-10T15:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/40fd134e669479e715338ac4a496af5c058f38de2d51fa20e622144f4a55e368"}
{"level":"info","ts":"2026-07-10T15:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1c937833650ac79317bc49865368786d14e6f10abcc89892e41cc566f549a940"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19"}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19"}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19"}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19"}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1"}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd"}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2"}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2"}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2"}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"}
{"level":"debug","ts":"2026-07-10T15:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d"}
{"level":"debug","ts":"2026-07-10T15:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d"}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d"}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf"}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf"}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612"}
{"level":"error","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612"}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85a338b661d685e986cfaac5424dc660b71f5c9ba2c516d1660cc8a3a03369ef","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85a338b661d685e986cfaac5424dc660b71f5c9ba2c516d1660cc8a3a03369ef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85a338b661d685e986cfaac5424dc660b71f5c9ba2c516d1660cc8a3a03369ef","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85a338b661d685e986cfaac5424dc660b71f5c9ba2c516d1660cc8a3a03369ef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85a338b661d685e986cfaac5424dc660b71f5c9ba2c516d1660cc8a3a03369ef"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85a338b661d685e986cfaac5424dc660b71f5c9ba2c516d1660cc8a3a03369ef","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["85a338b661d685e986cfaac5424dc660b71f5c9ba2c516d1660cc8a3a03369ef"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85a338b661d685e986cfaac5424dc660b71f5c9ba2c516d1660cc8a3a03369ef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85a338b661d685e986cfaac5424dc660b71f5c9ba2c516d1660cc8a3a03369ef","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85a338b661d685e986cfaac5424dc660b71f5c9ba2c516d1660cc8a3a03369ef"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27"}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635"}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9"}
{"level":"info","ts":"2026-07-10T15:09:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635"}
{"level":"debug","ts":"2026-07-10T15:09:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9"}
{"level":"info","ts":"2026-07-10T15:09:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"65e99aefaf0a4fbda40f9629e251b16dcba6085afac52a6a1a741fe4c1161e64","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa"}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/65e99aefaf0a4fbda40f9629e251b16dcba6085afac52a6a1a741fe4c1161e64"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2"}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"}
{"level":"debug","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17"}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf"}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7d9190ab0e3c3536324ba58be67defdd39e1176e5014e932b33b7ff1c1457dcd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d"}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7d9190ab0e3c3536324ba58be67defdd39e1176e5014e932b33b7ff1c1457dcd"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31e919f74ebc5d347fadbfb5bb05bf0a5e1f2025f39ceda85219a096d6811bcb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31e919f74ebc5d347fadbfb5bb05bf0a5e1f2025f39ceda85219a096d6811bcb"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27"}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612"}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:09:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85a338b661d685e986cfaac5424dc660b71f5c9ba2c516d1660cc8a3a03369ef","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19"}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85a338b661d685e986cfaac5424dc660b71f5c9ba2c516d1660cc8a3a03369ef"}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1"}
{"level":"info","ts":"2026-07-10T15:09:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"info","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:48768","PortSpecifier":{"PortValue":48768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:48768","PortSpecifier":{"PortValue":48768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696202,"nanos":392816309},"http":{"id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/sub-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37c5a7d1-3102-440d-9fb5-d82362a9975f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c0982955-a629-43c7-8717-50c3f4338a72","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:41002","PortSpecifier":{"PortValue":41002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c0982955-a629-43c7-8717-50c3f4338a72","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c0982955-a629-43c7-8717-50c3f4338a72","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:41002","PortSpecifier":{"PortValue":41002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696202,"nanos":438191662},"http":{"id":"c0982955-a629-43c7-8717-50c3f4338a72","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c0982955-a629-43c7-8717-50c3f4338a72","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c0982955-a629-43c7-8717-50c3f4338a72","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c0982955-a629-43c7-8717-50c3f4338a72","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c0982955-a629-43c7-8717-50c3f4338a72","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c0982955-a629-43c7-8717-50c3f4338a72","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c0982955-a629-43c7-8717-50c3f4338a72","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/sub-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c0982955-a629-43c7-8717-50c3f4338a72","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c0982955-a629-43c7-8717-50c3f4338a72","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c0982955-a629-43c7-8717-50c3f4338a72","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c0982955-a629-43c7-8717-50c3f4338a72","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c0982955-a629-43c7-8717-50c3f4338a72","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:48774","PortSpecifier":{"PortValue":48774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:48774","PortSpecifier":{"PortValue":48774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696202,"nanos":506144776},"http":{"id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","method":"GET","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cqLuMkcInoLO3T4t_NOMpJW7ZEWgkatag9PeCtvbnjiu1BOcxGsM862UuH4i"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cqLuMkcInoLO3T4t_NOMpJW7ZEWgkatag9PeCtvbnjiu1BOcxGsM862UuH4i\"}"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a50b7353-dc0f-46f4-b1aa-59378b6b45f1","keyName":"e2e-sub-iso-39b640","subscription":"e2e-a-only-cbc3ff","tenant":"e2e-shared-a-1f1c9a","userId":"a50b7353-dc0f-46f4-b1aa-59378b6b45f1","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/sub-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-a-only-cbc3ff"}
{"level":"info","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ecbb8fe3-66cf-4d9f-9a3e-d713cc3f6656","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1662248e-f11e-446e-b0db-4a6776444da2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:41016","PortSpecifier":{"PortValue":41016}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1662248e-f11e-446e-b0db-4a6776444da2","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1662248e-f11e-446e-b0db-4a6776444da2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:41016","PortSpecifier":{"PortValue":41016}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696202,"nanos":549427041},"http":{"id":"1662248e-f11e-446e-b0db-4a6776444da2","method":"GET","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1662248e-f11e-446e-b0db-4a6776444da2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1D4vyjigVofcwiXjU_xmE2asWx61SFsKSukkSbtx2XL7V8GxibHwfd0F24TzH"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1662248e-f11e-446e-b0db-4a6776444da2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1D4vyjigVofcwiXjU_xmE2asWx61SFsKSukkSbtx2XL7V8GxibHwfd0F24TzH\"}"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1662248e-f11e-446e-b0db-4a6776444da2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"35ce94e3-d80a-400a-b7e1-fc9809b25db3","keyName":"e2e-sub-iso-4069d2","subscription":"e2e-b-only-cbc3ff","tenant":"e2e-shared-b-f923ab","userId":"35ce94e3-d80a-400a-b7e1-fc9809b25db3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1662248e-f11e-446e-b0db-4a6776444da2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1662248e-f11e-446e-b0db-4a6776444da2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1662248e-f11e-446e-b0db-4a6776444da2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1662248e-f11e-446e-b0db-4a6776444da2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/sub-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1662248e-f11e-446e-b0db-4a6776444da2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1662248e-f11e-446e-b0db-4a6776444da2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1662248e-f11e-446e-b0db-4a6776444da2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-b-only-cbc3ff"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1662248e-f11e-446e-b0db-4a6776444da2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1662248e-f11e-446e-b0db-4a6776444da2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:10:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1662248e-f11e-446e-b0db-4a6776444da2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:46598","PortSpecifier":{"PortValue":46598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:46598","PortSpecifier":{"PortValue":46598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696219,"nanos":257029901},"http":{"id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/sub-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ee92e2f-1f86-41c1-9b54-866165811dfb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"febc4927-f761-41d7-b9a5-f5780488f564","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:54430","PortSpecifier":{"PortValue":54430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"febc4927-f761-41d7-b9a5-f5780488f564","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"febc4927-f761-41d7-b9a5-f5780488f564","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:54430","PortSpecifier":{"PortValue":54430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696219,"nanos":295851844},"http":{"id":"febc4927-f761-41d7-b9a5-f5780488f564","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"febc4927-f761-41d7-b9a5-f5780488f564","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"febc4927-f761-41d7-b9a5-f5780488f564","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"febc4927-f761-41d7-b9a5-f5780488f564","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"febc4927-f761-41d7-b9a5-f5780488f564","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"febc4927-f761-41d7-b9a5-f5780488f564","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"febc4927-f761-41d7-b9a5-f5780488f564","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/sub-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"febc4927-f761-41d7-b9a5-f5780488f564","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"febc4927-f761-41d7-b9a5-f5780488f564","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"febc4927-f761-41d7-b9a5-f5780488f564","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"febc4927-f761-41d7-b9a5-f5780488f564","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"febc4927-f761-41d7-b9a5-f5780488f564","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:46600","PortSpecifier":{"PortValue":46600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:46600","PortSpecifier":{"PortValue":46600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696219,"nanos":337464741},"http":{"id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bMk2Z6RfoAukAEaP_srpJz7imFg3AfLOMXOevhZ1CYvMMVxAmpL1Pdrpnipu"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bMk2Z6RfoAukAEaP_srpJz7imFg3AfLOMXOevhZ1CYvMMVxAmpL1Pdrpnipu\"}"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a139ae8a-837f-4842-aac9-3f62b7a27c98","keyName":"e2e-sub-iso-0817e1","subscription":"e2e-shared-sub-4de688","tenant":"e2e-shared-a-1f1c9a","userId":"a139ae8a-837f-4842-aac9-3f62b7a27c98","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/sub-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-4de688"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f73f1fa8-4bca-4815-a17b-a7d637df8a0e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:54442","PortSpecifier":{"PortValue":54442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:54442","PortSpecifier":{"PortValue":54442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696219,"nanos":370669475},"http":{"id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-BUdP5fLgnIPgMSxD_l5tDAvgl2E9PON1AJhzYaUyP8Aa0dJyI4hyBpUJkWmY"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-BUdP5fLgnIPgMSxD_l5tDAvgl2E9PON1AJhzYaUyP8Aa0dJyI4hyBpUJkWmY\"}"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f42f4d18-4d4c-44d6-93db-6283bfdbe001","keyName":"e2e-sub-iso-833923","subscription":"e2e-shared-sub-4de688","tenant":"e2e-shared-b-f923ab","userId":"f42f4d18-4d4c-44d6-93db-6283bfdbe001","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/sub-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-4de688"}
{"level":"info","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:10:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47510933-d767-4dff-8ebd-d6d529f9fcf8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a5cf72b4d8578b01fe71e6e7307ad3bd268dfccb5a121964905958747e9e38cf"}
{"level":"info","ts":"2026-07-10T15:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/64c0d5bc2abc97bd8bc05ef3fcd8654f6b40d20e45c9be5fd47364d60c8a4f19"}
{"level":"info","ts":"2026-07-10T15:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee0101dacb488c2d44b4d5b01c09c141867f59afe6b779877409390b55d2dddf"}
{"level":"info","ts":"2026-07-10T15:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bfd0135f6bc66571cec3ee42173287367863f590f79faee0af83a89922aa0da3"}
{"level":"info","ts":"2026-07-10T15:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a144a4ac3595e87eab1a8daaceae8341d6cd6b4999b85f3c70a33a902d61196c"}
{"level":"info","ts":"2026-07-10T15:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ec9ac88f15c73407fafcdfabcd35be066f7995d808fe8c9c3dbfd69b6c0708a2"}
{"level":"info","ts":"2026-07-10T15:10:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/09b69b79b06fdba0ea9799a8efebef73903868e38891a38f7e2cdb6df5c24612"}
{"level":"info","ts":"2026-07-10T15:10:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/23615de6ca2980f3aef7c5030e655dff409b2f393265e15a5ced0dec117b361d"}
{"level":"info","ts":"2026-07-10T15:10:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/da15f413a54ac572e5271ac34deea90bbc26d5f988f7d1dc135a3c9b569d5d17"}
{"level":"info","ts":"2026-07-10T15:10:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9c1fd9d0af79f3f0d674dc41a4219eaa9453b2135f06afc67fc02159f6f479c9"}
{"level":"info","ts":"2026-07-10T15:10:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7c44476d383f1024c611157a10be83a5100bda092814a8bf19c3487a90e0af27"}
{"level":"info","ts":"2026-07-10T15:10:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/86a47a0772a3259e14811c6258d6a8c3cfdaa5952ab2b96b65b4927a695e4635"}
{"level":"info","ts":"2026-07-10T15:10:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dae5f64da4bd4f9e476c7b26e366aa19efdf2a53bed818ab93b95aca76c0ccbd"}
{"level":"info","ts":"2026-07-10T15:10:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/479bcdf8ea738bb510d65ac8cd80be97ed3efe7b0f1d85471d68ee97fad49cb1"}
{"level":"info","ts":"2026-07-10T15:10:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7645b98eb765bb368c5f1311b2a9d5a3d78799f0357ad092ae3c8ca53c3412e7"}
{"level":"info","ts":"2026-07-10T15:10:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85a338b661d685e986cfaac5424dc660b71f5c9ba2c516d1660cc8a3a03369ef"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0ffb05adb4a1f820d5fc3e4f7c92c9d92ba46f643bbc3f5626d8208d57310420","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0ffb05adb4a1f820d5fc3e4f7c92c9d92ba46f643bbc3f5626d8208d57310420"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0ffb05adb4a1f820d5fc3e4f7c92c9d92ba46f643bbc3f5626d8208d57310420","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0ffb05adb4a1f820d5fc3e4f7c92c9d92ba46f643bbc3f5626d8208d57310420","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0ffb05adb4a1f820d5fc3e4f7c92c9d92ba46f643bbc3f5626d8208d57310420"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0ffb05adb4a1f820d5fc3e4f7c92c9d92ba46f643bbc3f5626d8208d57310420","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0ffb05adb4a1f820d5fc3e4f7c92c9d92ba46f643bbc3f5626d8208d57310420"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0ffb05adb4a1f820d5fc3e4f7c92c9d92ba46f643bbc3f5626d8208d57310420","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0ffb05adb4a1f820d5fc3e4f7c92c9d92ba46f643bbc3f5626d8208d57310420"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476"}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b"}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b"}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b"}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b"}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992"}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:10:35Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b"}
{"level":"debug","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"}
{"level":"info","ts":"2026-07-10T15:10:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992"}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd"}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd"}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd"}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b"}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b"}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b"}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b"}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b"}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b"}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca"}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca"}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984"}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca"}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0dcfcf638a0f2f578394a97e2837303c3e872b12783db80f68f8ecb4b98e1399","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0dcfcf638a0f2f578394a97e2837303c3e872b12783db80f68f8ecb4b98e1399","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0dcfcf638a0f2f578394a97e2837303c3e872b12783db80f68f8ecb4b98e1399","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0dcfcf638a0f2f578394a97e2837303c3e872b12783db80f68f8ecb4b98e1399"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0dcfcf638a0f2f578394a97e2837303c3e872b12783db80f68f8ecb4b98e1399","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0dcfcf638a0f2f578394a97e2837303c3e872b12783db80f68f8ecb4b98e1399"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0dcfcf638a0f2f578394a97e2837303c3e872b12783db80f68f8ecb4b98e1399","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0dcfcf638a0f2f578394a97e2837303c3e872b12783db80f68f8ecb4b98e1399","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b"}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0dcfcf638a0f2f578394a97e2837303c3e872b12783db80f68f8ecb4b98e1399"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"debug","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84"}
{"level":"debug","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd"}
{"level":"debug","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd"}
{"level":"debug","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd"}
{"level":"debug","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984"}
{"level":"info","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0ffb05adb4a1f820d5fc3e4f7c92c9d92ba46f643bbc3f5626d8208d57310420","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0dcfcf638a0f2f578394a97e2837303c3e872b12783db80f68f8ecb4b98e1399","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0ffb05adb4a1f820d5fc3e4f7c92c9d92ba46f643bbc3f5626d8208d57310420"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"65e99aefaf0a4fbda40f9629e251b16dcba6085afac52a6a1a741fe4c1161e64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T15:11:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0dcfcf638a0f2f578394a97e2837303c3e872b12783db80f68f8ecb4b98e1399"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/65e99aefaf0a4fbda40f9629e251b16dcba6085afac52a6a1a741fe4c1161e64"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7d9190ab0e3c3536324ba58be67defdd39e1176e5014e932b33b7ff1c1457dcd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31e919f74ebc5d347fadbfb5bb05bf0a5e1f2025f39ceda85219a096d6811bcb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7d9190ab0e3c3536324ba58be67defdd39e1176e5014e932b33b7ff1c1457dcd"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31e919f74ebc5d347fadbfb5bb05bf0a5e1f2025f39ceda85219a096d6811bcb"}
{"level":"info","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37660","PortSpecifier":{"PortValue":37660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0cc642e1-dabe-4986-9d75-90d9997156b5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37660","PortSpecifier":{"PortValue":37660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696277,"nanos":973028801},"http":{"id":"0cc642e1-dabe-4986-9d75-90d9997156b5","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:35400","PortSpecifier":{"PortValue":35400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"adb473d8-83ff-49df-88ff-08f5fe192432","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:35400","PortSpecifier":{"PortValue":35400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696278,"nanos":14879186},"http":{"id":"adb473d8-83ff-49df-88ff-08f5fe192432","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37668","PortSpecifier":{"PortValue":37668}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37668","PortSpecifier":{"PortValue":37668}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696278,"nanos":53806189},"http":{"id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37678","PortSpecifier":{"PortValue":37678}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"94017c2b-3daa-4215-94f5-f96106e773d6","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37678","PortSpecifier":{"PortValue":37678}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696279,"nanos":128994933},"http":{"id":"94017c2b-3daa-4215-94f5-f96106e773d6","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37686","PortSpecifier":{"PortValue":37686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37686","PortSpecifier":{"PortValue":37686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696280,"nanos":173788619},"http":{"id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37692","PortSpecifier":{"PortValue":37692}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37692","PortSpecifier":{"PortValue":37692}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696281,"nanos":218786099},"http":{"id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37704","PortSpecifier":{"PortValue":37704}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37704","PortSpecifier":{"PortValue":37704}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696282,"nanos":267106501},"http":{"id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37708","PortSpecifier":{"PortValue":37708}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37708","PortSpecifier":{"PortValue":37708}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696283,"nanos":312466564},"http":{"id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39614","PortSpecifier":{"PortValue":39614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39614","PortSpecifier":{"PortValue":39614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696284,"nanos":352128631},"http":{"id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39628","PortSpecifier":{"PortValue":39628}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39628","PortSpecifier":{"PortValue":39628}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696285,"nanos":390778528},"http":{"id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39638","PortSpecifier":{"PortValue":39638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39638","PortSpecifier":{"PortValue":39638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696286,"nanos":428693672},"http":{"id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39646","PortSpecifier":{"PortValue":39646}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39646","PortSpecifier":{"PortValue":39646}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696287,"nanos":467521803},"http":{"id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39648","PortSpecifier":{"PortValue":39648}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39648","PortSpecifier":{"PortValue":39648}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696288,"nanos":510311073},"http":{"id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39662","PortSpecifier":{"PortValue":39662}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39662","PortSpecifier":{"PortValue":39662}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696289,"nanos":550180895},"http":{"id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55682","PortSpecifier":{"PortValue":55682}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55682","PortSpecifier":{"PortValue":55682}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696298,"nanos":384549542},"http":{"id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:33588","PortSpecifier":{"PortValue":33588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:33588","PortSpecifier":{"PortValue":33588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696298,"nanos":424202131},"http":{"id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55690","PortSpecifier":{"PortValue":55690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55690","PortSpecifier":{"PortValue":55690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696298,"nanos":466648811},"http":{"id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55692","PortSpecifier":{"PortValue":55692}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ea55605b-ab6e-4bad-9609-f6258b150960","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55692","PortSpecifier":{"PortValue":55692}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696299,"nanos":501528702},"http":{"id":"ea55605b-ab6e-4bad-9609-f6258b150960","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84851281-b93f-42fc-9182-1917cc00e28c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55696","PortSpecifier":{"PortValue":55696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"84851281-b93f-42fc-9182-1917cc00e28c","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84851281-b93f-42fc-9182-1917cc00e28c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55696","PortSpecifier":{"PortValue":55696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696300,"nanos":538774393},"http":{"id":"84851281-b93f-42fc-9182-1917cc00e28c","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"84851281-b93f-42fc-9182-1917cc00e28c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84851281-b93f-42fc-9182-1917cc00e28c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84851281-b93f-42fc-9182-1917cc00e28c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55706","PortSpecifier":{"PortValue":55706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b484361-636a-432e-a7bd-d2d35152edfa","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55706","PortSpecifier":{"PortValue":55706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696301,"nanos":577129560},"http":{"id":"3b484361-636a-432e-a7bd-d2d35152edfa","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55720","PortSpecifier":{"PortValue":55720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55720","PortSpecifier":{"PortValue":55720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696302,"nanos":614874714},"http":{"id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44508","PortSpecifier":{"PortValue":44508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44508","PortSpecifier":{"PortValue":44508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696303,"nanos":663665440},"http":{"id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44522","PortSpecifier":{"PortValue":44522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44522","PortSpecifier":{"PortValue":44522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696304,"nanos":697994454},"http":{"id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44530","PortSpecifier":{"PortValue":44530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"082c8058-a3fb-4902-a033-0d2a319e1207","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44530","PortSpecifier":{"PortValue":44530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696305,"nanos":734156440},"http":{"id":"082c8058-a3fb-4902-a033-0d2a319e1207","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44536","PortSpecifier":{"PortValue":44536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0256812f-9ca1-4be4-bbaa-776195201cf5","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44536","PortSpecifier":{"PortValue":44536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696306,"nanos":773032206},"http":{"id":"0256812f-9ca1-4be4-bbaa-776195201cf5","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44538","PortSpecifier":{"PortValue":44538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cbcc0923-be89-492f-a3db-6c63766e9956","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44538","PortSpecifier":{"PortValue":44538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696307,"nanos":808880621},"http":{"id":"cbcc0923-be89-492f-a3db-6c63766e9956","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:49408","PortSpecifier":{"PortValue":49408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","method":"POST","path":"/ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab/v1/completions","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:49408","PortSpecifier":{"PortValue":49408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696307,"nanos":848103746},"http":{"id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-LbwelWGb4qg4bXms_w6uLkmiGAFkUkcm7ibQaFPjGlsQZz5H0cFqSAH7riMJ"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-LbwelWGb4qg4bXms_w6uLkmiGAFkUkcm7ibQaFPjGlsQZz5H0cFqSAH7riMJ\"}"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"de597ae5-dfd4-4799-b859-8d9911f2232d","keyName":"e2e-rate-b-6ecbaf","subscription":"e2e-rate-iso-b-6ecbaf","tenant":"e2e-shared-b-f923ab","userId":"de597ae5-dfd4-4799-b859-8d9911f2232d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab\",\"requestedSubscription\":\"e2e-rate-iso-b-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-f923ab","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-6ecbaf","namespace":"ai-tenant-e2e-shared-b-f923ab","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"de597ae5-dfd4-4799-b859-8d9911f2232d","keyName":"e2e-rate-b-6ecbaf","selected_subscription":"e2e-rate-iso-b-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-b-f923ab/e2e-rate-iso-b-6ecbaf@ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-f923ab","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-6ecbaf","namespace":"ai-tenant-e2e-shared-b-f923ab","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b"}
{"level":"info","ts":"2026-07-10T15:11:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84"}
{"level":"info","ts":"2026-07-10T15:11:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca"}
{"level":"info","ts":"2026-07-10T15:11:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0ffb05adb4a1f820d5fc3e4f7c92c9d92ba46f643bbc3f5626d8208d57310420"}
{"level":"info","ts":"2026-07-10T15:11:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd"}
{"level":"info","ts":"2026-07-10T15:11:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0dcfcf638a0f2f578394a97e2837303c3e872b12783db80f68f8ecb4b98e1399"}
{"level":"info","ts":"2026-07-10T15:12:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa"}
{"level":"info","ts":"2026-07-10T15:12:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"}
{"level":"info","ts":"2026-07-10T15:12:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/31e919f74ebc5d347fadbfb5bb05bf0a5e1f2025f39ceda85219a096d6811bcb"}
{"level":"info","ts":"2026-07-10T15:12:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/65e99aefaf0a4fbda40f9629e251b16dcba6085afac52a6a1a741fe4c1161e64"}
{"level":"info","ts":"2026-07-10T15:12:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b"}
{"level":"info","ts":"2026-07-10T15:12:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7d9190ab0e3c3536324ba58be67defdd39e1176e5014e932b33b7ff1c1457dcd"}
{"level":"info","ts":"2026-07-10T15:12:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"}
{"level":"info","ts":"2026-07-10T15:12:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"}