{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bd8a35ef86981994abed12c65ac256dfbec8ca1bb61f427abb6253693e2aa29f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bd8a35ef86981994abed12c65ac256dfbec8ca1bb61f427abb6253693e2aa29f"}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bd8a35ef86981994abed12c65ac256dfbec8ca1bb61f427abb6253693e2aa29f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bd8a35ef86981994abed12c65ac256dfbec8ca1bb61f427abb6253693e2aa29f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bd8a35ef86981994abed12c65ac256dfbec8ca1bb61f427abb6253693e2aa29f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bd8a35ef86981994abed12c65ac256dfbec8ca1bb61f427abb6253693e2aa29f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bd8a35ef86981994abed12c65ac256dfbec8ca1bb61f427abb6253693e2aa29f"}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bd8a35ef86981994abed12c65ac256dfbec8ca1bb61f427abb6253693e2aa29f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bd8a35ef86981994abed12c65ac256dfbec8ca1bb61f427abb6253693e2aa29f"}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:11:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:11:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"}
{"level":"debug","ts":"2026-07-05T20:12:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:12:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:12:06Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"}
{"level":"debug","ts":"2026-07-05T20:12:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"34951b936d3776c43a9fe08aac8ef6173640e2a0de205268de142a4a37da1cb5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34951b936d3776c43a9fe08aac8ef6173640e2a0de205268de142a4a37da1cb5"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"32d95c2a8fcd14bdab3f1c0cf60327ac29762f233e525fcf9783da2eab14d4c4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32d95c2a8fcd14bdab3f1c0cf60327ac29762f233e525fcf9783da2eab14d4c4"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c4f99a6b97f246fabace8d56656496ea78154b654da65418215bc2db78ade4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c4f99a6b97f246fabace8d56656496ea78154b654da65418215bc2db78ade4b"}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1f5bce244102ff39007c0930ff8c9627eb0680f0b5fe526507fe5be07e37f89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad4b9f1d7e7b1d005dfaf2c8de6522f639cbffc7106d9d98d01e9bd6d3b0473d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1f5bce244102ff39007c0930ff8c9627eb0680f0b5fe526507fe5be07e37f89"}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad4b9f1d7e7b1d005dfaf2c8de6522f639cbffc7106d9d98d01e9bd6d3b0473d"}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"aa19c5e864662748183d2f5e327f681f82630dbbf21aea1b8849733119adaf82","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4fc5fc830ab4bc920b82404287549a54e3fbb5417c0b1d1a46b99350c00245b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aa19c5e864662748183d2f5e327f681f82630dbbf21aea1b8849733119adaf82"}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fc5fc830ab4bc920b82404287549a54e3fbb5417c0b1d1a46b99350c00245b3"}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7b5275760ece018e34a1e424681fe412e2f88fc047a4ab85d79e8ac8035deb6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7b5275760ece018e34a1e424681fe412e2f88fc047a4ab85d79e8ac8035deb6"}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019"}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30b5dae009ee2807290974e6b4f01845b4b815352d017f4bb8c16a6b61ab8819","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30b5dae009ee2807290974e6b4f01845b4b815352d017f4bb8c16a6b61ab8819"}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e92c5899307f917b397acd0d0f68d4515d070326a975efebcbca7f15402a7272","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718"}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e92c5899307f917b397acd0d0f68d4515d070326a975efebcbca7f15402a7272"}
{"level":"info","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-05T20:12:07Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718"}
{"level":"info","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718"}
{"level":"debug","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0b6e12c5e8e999af4adf079025c3820257b39ee3ab0e144ad3813047dea25fd3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718"}
{"level":"debug","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cd73c0140d8a6e5f28ca20c3c5a798343e0b654820a2ccad27e8d7c922456e0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0b6e12c5e8e999af4adf079025c3820257b39ee3ab0e144ad3813047dea25fd3"}
{"level":"debug","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30cda358b1b0c8ada24c7283cc6118c0d0c0ef3bd9b290c4762d4b7aae63663c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-05T20:12:08Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-05T20:12:08Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bd8a35ef86981994abed12c65ac256dfbec8ca1bb61f427abb6253693e2aa29f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cd73c0140d8a6e5f28ca20c3c5a798343e0b654820a2ccad27e8d7c922456e0"}
{"level":"info","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30cda358b1b0c8ada24c7283cc6118c0d0c0ef3bd9b290c4762d4b7aae63663c"}
{"level":"info","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bd8a35ef86981994abed12c65ac256dfbec8ca1bb61f427abb6253693e2aa29f"}
{"level":"debug","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9fd73cc03ccdf994c01e09a5f385c9ac51117742b18f7326a9b058a8299eb378","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718"}
{"level":"info","ts":"2026-07-05T20:12:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9fd73cc03ccdf994c01e09a5f385c9ac51117742b18f7326a9b058a8299eb378"}
{"level":"info","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:35996","PortSpecifier":{"PortValue":35996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:35996","PortSpecifier":{"PortValue":35996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282329,"nanos":538657396},"http":{"id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"194493da-c643-4106-84be-40e77e620680","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=120c6712-5da3-498d-b760-248e4ea7ef6d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe635c3faecd"]}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe635c3faecd"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=120c6712-5da3-498d-b760-248e4ea7ef6d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"194493da-c643-4106-84be-40e77e620680","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4cd73c0140d8a6e5f28ca20c3c5a798343e0b654820a2ccad27e8d7c922456e0"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.46:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05dd7a07-c4e5-4ad8-ba6c-f7bdf6fa4db9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54418","PortSpecifier":{"PortValue":54418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-65fb4d.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54418","PortSpecifier":{"PortValue":54418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282329,"nanos":590576753},"http":{"id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","method":"POST","headers":{":authority":"e2e-shared-b-65fb4d.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"194493da-c643-4106-84be-40e77e620680","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=120c6712-5da3-498d-b760-248e4ea7ef6d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe635c3faecd"]}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe635c3faecd"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=120c6712-5da3-498d-b760-248e4ea7ef6d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"194493da-c643-4106-84be-40e77e620680","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ad4b9f1d7e7b1d005dfaf2c8de6522f639cbffc7106d9d98d01e9bd6d3b0473d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-65fb4d.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-65fb4d/rate-test-model-65fb4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5fb5e94e-03b4-4798-b6fd-251d12b9974e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:36010","PortSpecifier":{"PortValue":36010}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:36010","PortSpecifier":{"PortValue":36010}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282329,"nanos":644820116},"http":{"id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dfmxdh4ZLQQbR15K_hoCjj3T0FSeDBmZRN2GXKfeGOKgcdm4H62zPWuJQ8Wv"}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dfmxdh4ZLQQbR15K_hoCjj3T0FSeDBmZRN2GXKfeGOKgcdm4H62zPWuJQ8Wv\"}"}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ff3731f8-63e8-4cc0-a30e-b5aae212bb4a","keyName":"e2e-rate-a-fe8539","subscription":"e2e-rate-iso-a-fe8539","tenant":"e2e-shared-a-d9296f","userId":"ff3731f8-63e8-4cc0-a30e-b5aae212bb4a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-fe8539\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fe8539","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fe8539"}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ff3731f8-63e8-4cc0-a30e-b5aae212bb4a","keyName":"e2e-rate-a-fe8539","selected_subscription":"e2e-rate-iso-a-fe8539","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-fe8539@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fe8539","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ef65e9f-c2da-43eb-aa16-4ece1b3c70a6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:36012","PortSpecifier":{"PortValue":36012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:36012","PortSpecifier":{"PortValue":36012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282330,"nanos":701541078},"http":{"id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dfmxdh4ZLQQbR15K_hoCjj3T0FSeDBmZRN2GXKfeGOKgcdm4H62zPWuJQ8Wv"}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dfmxdh4ZLQQbR15K_hoCjj3T0FSeDBmZRN2GXKfeGOKgcdm4H62zPWuJQ8Wv\"}"}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ff3731f8-63e8-4cc0-a30e-b5aae212bb4a","keyName":"e2e-rate-a-fe8539","subscription":"e2e-rate-iso-a-fe8539","tenant":"e2e-shared-a-d9296f","userId":"ff3731f8-63e8-4cc0-a30e-b5aae212bb4a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-fe8539\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fe8539","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fe8539"}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ff3731f8-63e8-4cc0-a30e-b5aae212bb4a","keyName":"e2e-rate-a-fe8539","selected_subscription":"e2e-rate-iso-a-fe8539","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-fe8539@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fe8539","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0e753ba1-0dc0-415e-b98b-bf2f9dc30c03","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:36022","PortSpecifier":{"PortValue":36022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:36022","PortSpecifier":{"PortValue":36022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282331,"nanos":736663366},"http":{"id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dfmxdh4ZLQQbR15K_hoCjj3T0FSeDBmZRN2GXKfeGOKgcdm4H62zPWuJQ8Wv"}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dfmxdh4ZLQQbR15K_hoCjj3T0FSeDBmZRN2GXKfeGOKgcdm4H62zPWuJQ8Wv\"}"}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ff3731f8-63e8-4cc0-a30e-b5aae212bb4a","keyName":"e2e-rate-a-fe8539","subscription":"e2e-rate-iso-a-fe8539","tenant":"e2e-shared-a-d9296f","userId":"ff3731f8-63e8-4cc0-a30e-b5aae212bb4a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-fe8539\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fe8539","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-fe8539"}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ff3731f8-63e8-4cc0-a30e-b5aae212bb4a","keyName":"e2e-rate-a-fe8539","selected_subscription":"e2e-rate-iso-a-fe8539","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-fe8539@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-fe8539","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ea8ab4a-2776-4678-9253-546dae2a9d25","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44712","PortSpecifier":{"PortValue":44712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44712","PortSpecifier":{"PortValue":44712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282338,"nanos":362832033},"http":{"id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"194493da-c643-4106-84be-40e77e620680","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=120c6712-5da3-498d-b760-248e4ea7ef6d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe635c3faecd"]}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe635c3faecd"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=120c6712-5da3-498d-b760-248e4ea7ef6d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"194493da-c643-4106-84be-40e77e620680","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4cd73c0140d8a6e5f28ca20c3c5a798343e0b654820a2ccad27e8d7c922456e0"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.46:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ec72bb4-7566-419e-ac48-007104c0d5b9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57159da7-7005-4e24-989b-879b49806108","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:60486","PortSpecifier":{"PortValue":60486}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"57159da7-7005-4e24-989b-879b49806108","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-65fb4d.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57159da7-7005-4e24-989b-879b49806108","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:60486","PortSpecifier":{"PortValue":60486}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282338,"nanos":427357770},"http":{"id":"57159da7-7005-4e24-989b-879b49806108","method":"POST","headers":{":authority":"e2e-shared-b-65fb4d.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"57159da7-7005-4e24-989b-879b49806108","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"57159da7-7005-4e24-989b-879b49806108","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"194493da-c643-4106-84be-40e77e620680","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=120c6712-5da3-498d-b760-248e4ea7ef6d"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe635c3faecd"]}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"57159da7-7005-4e24-989b-879b49806108","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe635c3faecd"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=120c6712-5da3-498d-b760-248e4ea7ef6d"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"194493da-c643-4106-84be-40e77e620680","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ad4b9f1d7e7b1d005dfaf2c8de6522f639cbffc7106d9d98d01e9bd6d3b0473d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-65fb4d.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57159da7-7005-4e24-989b-879b49806108","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57159da7-7005-4e24-989b-879b49806108","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57159da7-7005-4e24-989b-879b49806108","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-65fb4d/rate-test-model-65fb4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"57159da7-7005-4e24-989b-879b49806108","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57159da7-7005-4e24-989b-879b49806108","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57159da7-7005-4e24-989b-879b49806108","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57159da7-7005-4e24-989b-879b49806108","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57159da7-7005-4e24-989b-879b49806108","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44720","PortSpecifier":{"PortValue":44720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4b2255bb-1f31-4798-b078-e7cc6064af03","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44720","PortSpecifier":{"PortValue":44720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282338,"nanos":482715107},"http":{"id":"4b2255bb-1f31-4798-b078-e7cc6064af03","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31"}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31\"}"}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","subscription":"e2e-rate-iso-a-451c7a","tenant":"e2e-shared-a-d9296f","userId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-451c7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-451c7a"}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","selected_subscription":"e2e-rate-iso-a-451c7a","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-451c7a@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b2255bb-1f31-4798-b078-e7cc6064af03","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44736","PortSpecifier":{"PortValue":44736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44736","PortSpecifier":{"PortValue":44736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282339,"nanos":520263944},"http":{"id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31"}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31\"}"}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","subscription":"e2e-rate-iso-a-451c7a","tenant":"e2e-shared-a-d9296f","userId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-451c7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-451c7a"}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","selected_subscription":"e2e-rate-iso-a-451c7a","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-451c7a@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0322ea41-1f95-4046-968a-b0e8d6955e4c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44738","PortSpecifier":{"PortValue":44738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44738","PortSpecifier":{"PortValue":44738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282340,"nanos":557896022},"http":{"id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31"}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31\"}"}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","subscription":"e2e-rate-iso-a-451c7a","tenant":"e2e-shared-a-d9296f","userId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-451c7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-451c7a"}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","selected_subscription":"e2e-rate-iso-a-451c7a","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-451c7a@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59ecdcc5-cabf-4d65-a59a-2af62661af04","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44752","PortSpecifier":{"PortValue":44752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7c10654f-829a-43bf-8940-ab34fdb71066","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44752","PortSpecifier":{"PortValue":44752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282341,"nanos":592602996},"http":{"id":"7c10654f-829a-43bf-8940-ab34fdb71066","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31"}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31\"}"}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","subscription":"e2e-rate-iso-a-451c7a","tenant":"e2e-shared-a-d9296f","userId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-451c7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-451c7a"}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","selected_subscription":"e2e-rate-iso-a-451c7a","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-451c7a@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c10654f-829a-43bf-8940-ab34fdb71066","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6621d43-7c2f-4a66-b043-568691a69174","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44764","PortSpecifier":{"PortValue":44764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f6621d43-7c2f-4a66-b043-568691a69174","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6621d43-7c2f-4a66-b043-568691a69174","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44764","PortSpecifier":{"PortValue":44764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282342,"nanos":636363922},"http":{"id":"f6621d43-7c2f-4a66-b043-568691a69174","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f6621d43-7c2f-4a66-b043-568691a69174","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31"}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f6621d43-7c2f-4a66-b043-568691a69174","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31\"}"}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f6621d43-7c2f-4a66-b043-568691a69174","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","subscription":"e2e-rate-iso-a-451c7a","tenant":"e2e-shared-a-d9296f","userId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f6621d43-7c2f-4a66-b043-568691a69174","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-451c7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f6621d43-7c2f-4a66-b043-568691a69174","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f6621d43-7c2f-4a66-b043-568691a69174","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6621d43-7c2f-4a66-b043-568691a69174","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6621d43-7c2f-4a66-b043-568691a69174","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6621d43-7c2f-4a66-b043-568691a69174","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6621d43-7c2f-4a66-b043-568691a69174","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6621d43-7c2f-4a66-b043-568691a69174","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6621d43-7c2f-4a66-b043-568691a69174","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-451c7a"}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6621d43-7c2f-4a66-b043-568691a69174","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6621d43-7c2f-4a66-b043-568691a69174","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","selected_subscription":"e2e-rate-iso-a-451c7a","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-451c7a@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6621d43-7c2f-4a66-b043-568691a69174","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6621d43-7c2f-4a66-b043-568691a69174","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44778","PortSpecifier":{"PortValue":44778}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44778","PortSpecifier":{"PortValue":44778}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282343,"nanos":675181799},"http":{"id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31"}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31\"}"}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","subscription":"e2e-rate-iso-a-451c7a","tenant":"e2e-shared-a-d9296f","userId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-451c7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-451c7a"}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","selected_subscription":"e2e-rate-iso-a-451c7a","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-451c7a@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29cb885d-5bbe-4a79-ade2-cb40f231dc22","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44784","PortSpecifier":{"PortValue":44784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cdb8f6ae-0660-42d8-890d-655d257fa527","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:44784","PortSpecifier":{"PortValue":44784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282344,"nanos":710344816},"http":{"id":"cdb8f6ae-0660-42d8-890d-655d257fa527","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31"}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31\"}"}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","subscription":"e2e-rate-iso-a-451c7a","tenant":"e2e-shared-a-d9296f","userId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-451c7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-451c7a"}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","selected_subscription":"e2e-rate-iso-a-451c7a","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-451c7a@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cdb8f6ae-0660-42d8-890d-655d257fa527","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51224","PortSpecifier":{"PortValue":51224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51224","PortSpecifier":{"PortValue":51224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282345,"nanos":748536723},"http":{"id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31"}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31\"}"}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","subscription":"e2e-rate-iso-a-451c7a","tenant":"e2e-shared-a-d9296f","userId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-451c7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-451c7a"}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","selected_subscription":"e2e-rate-iso-a-451c7a","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-451c7a@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ba6d115-7ea9-42d5-9aae-56ae4fa4adcb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51228","PortSpecifier":{"PortValue":51228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51228","PortSpecifier":{"PortValue":51228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282346,"nanos":783142019},"http":{"id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31"}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31\"}"}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","subscription":"e2e-rate-iso-a-451c7a","tenant":"e2e-shared-a-d9296f","userId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-451c7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-451c7a"}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","selected_subscription":"e2e-rate-iso-a-451c7a","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-451c7a@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31a85ecd-cbc2-4750-aaf8-c89f4fb2137d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51232","PortSpecifier":{"PortValue":51232}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51232","PortSpecifier":{"PortValue":51232}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282347,"nanos":817592085},"http":{"id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31"}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31\"}"}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","subscription":"e2e-rate-iso-a-451c7a","tenant":"e2e-shared-a-d9296f","userId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-451c7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-451c7a"}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","selected_subscription":"e2e-rate-iso-a-451c7a","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-451c7a@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63ee02b6-06bd-4e9a-bbf0-d069ff4dadc8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51236","PortSpecifier":{"PortValue":51236}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","method":"POST","path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions","host":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51236","PortSpecifier":{"PortValue":51236}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282348,"nanos":857742582},"http":{"id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","method":"POST","headers":{":authority":"e2e-shared-a-d9296f.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1btXULvEgG4bRkJAV_2QTuzUaji247a4trcimgRPjEq2HTL8w5aKa6E4M2H31\"}"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","subscription":"e2e-rate-iso-a-451c7a","tenant":"e2e-shared-a-d9296f","userId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\",\"requestedSubscription\":\"e2e-rate-iso-a-451c7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d9296f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-451c7a"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"72246add-d1ec-4583-bf1f-74b2e7e5cbdb","keyName":"e2e-rate-a-451c7a","selected_subscription":"e2e-rate-iso-a-451c7a","selected_subscription_key":"ai-tenant-e2e-shared-a-d9296f/e2e-rate-iso-a-451c7a@ai-tenant-e2e-shared-a-d9296f/rate-test-model-d9296f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d9296f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-451c7a","namespace":"ai-tenant-e2e-shared-a-d9296f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5d4f175-5fb7-49b3-9385-4ddce7c11be6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:55290","PortSpecifier":{"PortValue":55290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","method":"POST","path":"/ai-tenant-e2e-shared-b-65fb4d/rate-test-model-65fb4d/v1/completions","host":"e2e-shared-b-65fb4d.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:55290","PortSpecifier":{"PortValue":55290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783282348,"nanos":892516287},"http":{"id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","method":"POST","headers":{":authority":"e2e-shared-b-65fb4d.apps.e603dd5b-08ee-40f2-b1cd-fe635c3faecd.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-65fb4d/rate-test-model-65fb4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-z8It92mK58TphiH5_j6Am9tKZfa2WjdvQftehNnXgmJeKBV92MYXtNkliemM"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-65fb4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-z8It92mK58TphiH5_j6Am9tKZfa2WjdvQftehNnXgmJeKBV92MYXtNkliemM\"}"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-65fb4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d6135e25-5892-4472-9e4e-d9eafb81f831","keyName":"e2e-rate-b-451c7a","subscription":"e2e-rate-iso-b-451c7a","tenant":"e2e-shared-b-65fb4d","userId":"d6135e25-5892-4472-9e4e-d9eafb81f831","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-65fb4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-65fb4d/rate-test-model-65fb4d\",\"requestedSubscription\":\"e2e-rate-iso-b-451c7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-65fb4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-65fb4d","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-451c7a","namespace":"ai-tenant-e2e-shared-b-65fb4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-65fb4d/rate-test-model-65fb4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-451c7a"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d6135e25-5892-4472-9e4e-d9eafb81f831","keyName":"e2e-rate-b-451c7a","selected_subscription":"e2e-rate-iso-b-451c7a","selected_subscription_key":"ai-tenant-e2e-shared-b-65fb4d/e2e-rate-iso-b-451c7a@ai-tenant-e2e-shared-b-65fb4d/rate-test-model-65fb4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-65fb4d","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-451c7a","namespace":"ai-tenant-e2e-shared-b-65fb4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-05T20:12:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b53ebc5f-9a94-4cbc-9119-613daefa4c0a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-05T20:12:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/30b5dae009ee2807290974e6b4f01845b4b815352d017f4bb8c16a6b61ab8819"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/342dff0f76b4f8fb6fceeb077a598870ef5966f33c33b1d90917e3fbcd461718"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5e9bce44b2ab7b915d89113bb1af51084279cf940d684956815d341c431e5019"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a1f5bce244102ff39007c0930ff8c9627eb0680f0b5fe526507fe5be07e37f89"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4fc5fc830ab4bc920b82404287549a54e3fbb5417c0b1d1a46b99350c00245b3"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5f1da078aad486df34cadd380b07369ca9aeeb024f33174b6d6a1363c3227089"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9fd73cc03ccdf994c01e09a5f385c9ac51117742b18f7326a9b058a8299eb378"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/60bf86d55aad97aa58c4d83e017c17f11be69180d6390eb8b8c608325fc6d284"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bd8a35ef86981994abed12c65ac256dfbec8ca1bb61f427abb6253693e2aa29f"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c7b5275760ece018e34a1e424681fe412e2f88fc047a4ab85d79e8ac8035deb6"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/30cda358b1b0c8ada24c7283cc6118c0d0c0ef3bd9b290c4762d4b7aae63663c"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/34951b936d3776c43a9fe08aac8ef6173640e2a0de205268de142a4a37da1cb5"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e92c5899307f917b397acd0d0f68d4515d070326a975efebcbca7f15402a7272"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e442455723e6c69d34065414c754918099a84ad85029fbfca0e19e756d52db65"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/aa19c5e864662748183d2f5e327f681f82630dbbf21aea1b8849733119adaf82"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/32d95c2a8fcd14bdab3f1c0cf60327ac29762f233e525fcf9783da2eab14d4c4"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3c4f99a6b97f246fabace8d56656496ea78154b654da65418215bc2db78ade4b"}
{"level":"info","ts":"2026-07-05T20:12:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4cd73c0140d8a6e5f28ca20c3c5a798343e0b654820a2ccad27e8d7c922456e0"}
{"level":"info","ts":"2026-07-05T20:13:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ad4b9f1d7e7b1d005dfaf2c8de6522f639cbffc7106d9d98d01e9bd6d3b0473d"}
{"level":"info","ts":"2026-07-05T20:13:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0b6e12c5e8e999af4adf079025c3820257b39ee3ab0e144ad3813047dea25fd3"}