{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa"}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7d9190ab0e3c3536324ba58be67defdd39e1176e5014e932b33b7ff1c1457dcd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31e919f74ebc5d347fadbfb5bb05bf0a5e1f2025f39ceda85219a096d6811bcb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7d9190ab0e3c3536324ba58be67defdd39e1176e5014e932b33b7ff1c1457dcd"}
{"level":"info","ts":"2026-07-10T15:11:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31e919f74ebc5d347fadbfb5bb05bf0a5e1f2025f39ceda85219a096d6811bcb"}
{"level":"info","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37660","PortSpecifier":{"PortValue":37660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0cc642e1-dabe-4986-9d75-90d9997156b5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37660","PortSpecifier":{"PortValue":37660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696277,"nanos":973028801},"http":{"id":"0cc642e1-dabe-4986-9d75-90d9997156b5","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cc642e1-dabe-4986-9d75-90d9997156b5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:35400","PortSpecifier":{"PortValue":35400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"adb473d8-83ff-49df-88ff-08f5fe192432","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:35400","PortSpecifier":{"PortValue":35400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696278,"nanos":14879186},"http":{"id":"adb473d8-83ff-49df-88ff-08f5fe192432","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"adb473d8-83ff-49df-88ff-08f5fe192432","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37668","PortSpecifier":{"PortValue":37668}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37668","PortSpecifier":{"PortValue":37668}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696278,"nanos":53806189},"http":{"id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3d88576-3f0f-425c-aa6e-2d88c8de1ff2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37678","PortSpecifier":{"PortValue":37678}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"94017c2b-3daa-4215-94f5-f96106e773d6","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37678","PortSpecifier":{"PortValue":37678}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696279,"nanos":128994933},"http":{"id":"94017c2b-3daa-4215-94f5-f96106e773d6","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94017c2b-3daa-4215-94f5-f96106e773d6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37686","PortSpecifier":{"PortValue":37686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37686","PortSpecifier":{"PortValue":37686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696280,"nanos":173788619},"http":{"id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a701a2ef-09bf-42c2-ba9b-cecf66405c1c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37692","PortSpecifier":{"PortValue":37692}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37692","PortSpecifier":{"PortValue":37692}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696281,"nanos":218786099},"http":{"id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ebf8b82-fe86-48d4-ad41-f89a54401188","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37704","PortSpecifier":{"PortValue":37704}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37704","PortSpecifier":{"PortValue":37704}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696282,"nanos":267106501},"http":{"id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cb07568-b596-484e-b7c0-7b2c6b9ec076","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37708","PortSpecifier":{"PortValue":37708}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:37708","PortSpecifier":{"PortValue":37708}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696283,"nanos":312466564},"http":{"id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f69b59f0-783a-48a5-8c5e-7f1927ca5b96","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39614","PortSpecifier":{"PortValue":39614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39614","PortSpecifier":{"PortValue":39614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696284,"nanos":352128631},"http":{"id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5581ddf-f668-49f1-9aa8-20b1d51769e5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39628","PortSpecifier":{"PortValue":39628}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39628","PortSpecifier":{"PortValue":39628}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696285,"nanos":390778528},"http":{"id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebb063d5-f5ce-4c18-b7a3-9247b8d43d78","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39638","PortSpecifier":{"PortValue":39638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39638","PortSpecifier":{"PortValue":39638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696286,"nanos":428693672},"http":{"id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90172c18-ad36-4d35-9cbb-90797ebd3ae3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39646","PortSpecifier":{"PortValue":39646}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39646","PortSpecifier":{"PortValue":39646}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696287,"nanos":467521803},"http":{"id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37c5579d-1d23-4c25-9772-5ad5d1c704ac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39648","PortSpecifier":{"PortValue":39648}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39648","PortSpecifier":{"PortValue":39648}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696288,"nanos":510311073},"http":{"id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"286ff48a-8ca0-4031-a85e-097b4b3e60d4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39662","PortSpecifier":{"PortValue":39662}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:39662","PortSpecifier":{"PortValue":39662}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696289,"nanos":550180895},"http":{"id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ItqKcKL9lyighRun_leGuiMANCOXiqsO4UHFG8OFw3zTNyg8HDUJe1jztfI3\"}"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","subscription":"e2e-rate-iso-a-15a06f","tenant":"e2e-shared-a-1f1c9a","userId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-15a06f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15a06f"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9f8c09e0-cf85-40fa-8de2-7eece903775a","keyName":"e2e-rate-a-15a06f","selected_subscription":"e2e-rate-iso-a-15a06f","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-15a06f@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15a06f","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7573fb70-05f3-4f3b-baab-2b843b43c0da","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55682","PortSpecifier":{"PortValue":55682}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55682","PortSpecifier":{"PortValue":55682}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696298,"nanos":384549542},"http":{"id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c943824e-104d-4a51-b980-bf3bcf4bbc7c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:33588","PortSpecifier":{"PortValue":33588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:33588","PortSpecifier":{"PortValue":33588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696298,"nanos":424202131},"http":{"id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"]}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/ab30c88485f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c964d30-3673-435c-bebd-24481803dd5b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b1bbe3bf-23d9-4878-9c9f-dacc3dbc3f93","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23bba7b4-3906-4d96-a5d8-630d74e8f09b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55690","PortSpecifier":{"PortValue":55690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55690","PortSpecifier":{"PortValue":55690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696298,"nanos":466648811},"http":{"id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c050da2-0a80-4dd8-9e4b-f65584e01bc0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55692","PortSpecifier":{"PortValue":55692}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ea55605b-ab6e-4bad-9609-f6258b150960","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55692","PortSpecifier":{"PortValue":55692}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696299,"nanos":501528702},"http":{"id":"ea55605b-ab6e-4bad-9609-f6258b150960","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea55605b-ab6e-4bad-9609-f6258b150960","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84851281-b93f-42fc-9182-1917cc00e28c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55696","PortSpecifier":{"PortValue":55696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"84851281-b93f-42fc-9182-1917cc00e28c","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84851281-b93f-42fc-9182-1917cc00e28c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55696","PortSpecifier":{"PortValue":55696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696300,"nanos":538774393},"http":{"id":"84851281-b93f-42fc-9182-1917cc00e28c","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"84851281-b93f-42fc-9182-1917cc00e28c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84851281-b93f-42fc-9182-1917cc00e28c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84851281-b93f-42fc-9182-1917cc00e28c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84851281-b93f-42fc-9182-1917cc00e28c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55706","PortSpecifier":{"PortValue":55706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b484361-636a-432e-a7bd-d2d35152edfa","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55706","PortSpecifier":{"PortValue":55706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696301,"nanos":577129560},"http":{"id":"3b484361-636a-432e-a7bd-d2d35152edfa","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b484361-636a-432e-a7bd-d2d35152edfa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55720","PortSpecifier":{"PortValue":55720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55720","PortSpecifier":{"PortValue":55720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696302,"nanos":614874714},"http":{"id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0128ba71-6ddd-49b4-affd-b1c1fe1398a9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44508","PortSpecifier":{"PortValue":44508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44508","PortSpecifier":{"PortValue":44508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696303,"nanos":663665440},"http":{"id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c739cd5-ed63-4d45-bdd3-c4a1fa461c59","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44522","PortSpecifier":{"PortValue":44522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44522","PortSpecifier":{"PortValue":44522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696304,"nanos":697994454},"http":{"id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ac276dc-b093-4d12-a5bd-dbd7fdc5ef90","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44530","PortSpecifier":{"PortValue":44530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"082c8058-a3fb-4902-a033-0d2a319e1207","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44530","PortSpecifier":{"PortValue":44530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696305,"nanos":734156440},"http":{"id":"082c8058-a3fb-4902-a033-0d2a319e1207","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"082c8058-a3fb-4902-a033-0d2a319e1207","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44536","PortSpecifier":{"PortValue":44536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0256812f-9ca1-4be4-bbaa-776195201cf5","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44536","PortSpecifier":{"PortValue":44536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696306,"nanos":773032206},"http":{"id":"0256812f-9ca1-4be4-bbaa-776195201cf5","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0256812f-9ca1-4be4-bbaa-776195201cf5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44538","PortSpecifier":{"PortValue":44538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cbcc0923-be89-492f-a3db-6c63766e9956","method":"POST","path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions","host":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:44538","PortSpecifier":{"PortValue":44538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696307,"nanos":808880621},"http":{"id":"cbcc0923-be89-492f-a3db-6c63766e9956","method":"POST","headers":{":authority":"e2e-shared-a-1f1c9a.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1S8n2PGPmts3QozKv_tjvAcpjp3vOcw4hXPZYKr3USgAb8ZL58zzpAPaH29jI\"}"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","subscription":"e2e-rate-iso-a-6ecbaf","tenant":"e2e-shared-a-1f1c9a","userId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\",\"requestedSubscription\":\"e2e-rate-iso-a-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1f1c9a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3e7a1ca9-d67f-4733-8c8e-68d6786cba1a","keyName":"e2e-rate-a-6ecbaf","selected_subscription":"e2e-rate-iso-a-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-a-1f1c9a/e2e-rate-iso-a-6ecbaf@ai-tenant-e2e-shared-a-1f1c9a/rate-test-model-1f1c9a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1f1c9a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ecbaf","namespace":"ai-tenant-e2e-shared-a-1f1c9a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cbcc0923-be89-492f-a3db-6c63766e9956","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:49408","PortSpecifier":{"PortValue":49408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","method":"POST","path":"/ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab/v1/completions","host":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:49408","PortSpecifier":{"PortValue":49408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783696307,"nanos":848103746},"http":{"id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","method":"POST","headers":{":authority":"e2e-shared-b-f923ab.apps.9e86d521-f2ae-4423-a926-ab30c88485f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-LbwelWGb4qg4bXms_w6uLkmiGAFkUkcm7ibQaFPjGlsQZz5H0cFqSAH7riMJ"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-LbwelWGb4qg4bXms_w6uLkmiGAFkUkcm7ibQaFPjGlsQZz5H0cFqSAH7riMJ\"}"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"de597ae5-dfd4-4799-b859-8d9911f2232d","keyName":"e2e-rate-b-6ecbaf","subscription":"e2e-rate-iso-b-6ecbaf","tenant":"e2e-shared-b-f923ab","userId":"de597ae5-dfd4-4799-b859-8d9911f2232d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab\",\"requestedSubscription\":\"e2e-rate-iso-b-6ecbaf\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f923ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-f923ab","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-6ecbaf","namespace":"ai-tenant-e2e-shared-b-f923ab","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-6ecbaf"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"de597ae5-dfd4-4799-b859-8d9911f2232d","keyName":"e2e-rate-b-6ecbaf","selected_subscription":"e2e-rate-iso-b-6ecbaf","selected_subscription_key":"ai-tenant-e2e-shared-b-f923ab/e2e-rate-iso-b-6ecbaf@ai-tenant-e2e-shared-b-f923ab/rate-test-model-f923ab","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-f923ab","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-6ecbaf","namespace":"ai-tenant-e2e-shared-b-f923ab","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T15:11:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8faf8cd5-a3ef-4bf6-904e-ad77adfd5b2f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T15:11:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/169b9d614f9501da2217dbc659dbe8b9130695f18929fdee56a874cdb0e46e7b"}
{"level":"info","ts":"2026-07-10T15:11:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/71643ddfcf5868b8a0a51ee75cd397eee38288145f571cc563483f90aead1d84"}
{"level":"info","ts":"2026-07-10T15:11:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b0da7192cbc7dae9ffe118b1741905c5039f6e88d2183642ce8006bf5359d1ca"}
{"level":"info","ts":"2026-07-10T15:11:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0ffb05adb4a1f820d5fc3e4f7c92c9d92ba46f643bbc3f5626d8208d57310420"}
{"level":"info","ts":"2026-07-10T15:11:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/149395c14753591eee70efa5d508454b2b1b18c79ec6ea21fbfe77be122b92fd"}
{"level":"info","ts":"2026-07-10T15:11:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/37ed8a137a26d44a14e2d240c22ca112f57fea53c3e7065646e4ebbc31ef83da"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/299e12ad99f2d89807434140ac65a4b1f73722a38060889a041093abe041cc13"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3ba52c919cea2ad1091b13aa5e2a19661499b2594361bf585c7f1485005158d2"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b427542cbf74049c9031e1528a0ba6d898bc61f82cf3318757a37cddd410698d"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/79209133729d6a0c612c50f75cdc59792846b1e0414555a551cff74948b69476"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/121d56252a0b2a82ce632b3c02a397041ce0a8a52bb125316adbc3a7acbdc984"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f2b7da39178d37b0772eea3e83ae51aa5845e9853c3e5d7fc40cb5bf4c67b18b"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7e5c5fa6e92222b16238fed9f29fa7836893ad2e9eeca1307200b65fd7d5fe0b"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/315d22fb703d24698197d12cc0d63dbb390b2deb061a5f63798a75406d911a7b"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c193ca54096e94bb2a5ad0e51ff1d6212e6c2227105cf2a27aee88679ca00992"}
{"level":"info","ts":"2026-07-10T15:11:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0dcfcf638a0f2f578394a97e2837303c3e872b12783db80f68f8ecb4b98e1399"}
{"level":"info","ts":"2026-07-10T15:12:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0253330592ac6a0d76c688ce7bbda9a8deb956e464b91d41f1003f4c5014cbfa"}
{"level":"info","ts":"2026-07-10T15:12:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e4278648ddd64cdbae03acacf2cbb7dd594d80916b63f4f61f5436cf4c31b0ac"}
{"level":"info","ts":"2026-07-10T15:12:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/31e919f74ebc5d347fadbfb5bb05bf0a5e1f2025f39ceda85219a096d6811bcb"}
{"level":"info","ts":"2026-07-10T15:12:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/65e99aefaf0a4fbda40f9629e251b16dcba6085afac52a6a1a741fe4c1161e64"}
{"level":"info","ts":"2026-07-10T15:12:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d31e2cb30813bfe94095ff30ab6fed6b0ebaf0f962a47ed46b0d21270598213b"}
{"level":"info","ts":"2026-07-10T15:12:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7d9190ab0e3c3536324ba58be67defdd39e1176e5014e932b33b7ff1c1457dcd"}
{"level":"info","ts":"2026-07-10T15:12:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e89a4e88b46ead4bcf872c75077521b43f3ad0928e3ac985ea2618df42da14ac"}
{"level":"info","ts":"2026-07-10T15:12:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/670cc867a681b588a3eed8780f71a8b58c85d675802ec5050be1bd48782a0f37"}