{"level":"debug","ts":"2026-07-29T21:41:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b204d95-3bd3-4913-bb91-e81dd86cad78","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c929bf"}
{"level":"debug","ts":"2026-07-29T21:41:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b204d95-3bd3-4913-bb91-e81dd86cad78","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6114efae-d96e-4483-a626-ec1d39c75957","keyName":"e2e-rate-a-c929bf","selected_subscription":"e2e-rate-iso-a-c929bf","selected_subscription_key":"ai-tenant-e2e-shared-a-eb3087/e2e-rate-iso-a-c929bf@ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c929bf","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T21:41:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b204d95-3bd3-4913-bb91-e81dd86cad78","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:41:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b204d95-3bd3-4913-bb91-e81dd86cad78","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6179781d-c25b-4fe3-a440-c2cb36960f01","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53902","PortSpecifier":{"PortValue":53902}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6179781d-c25b-4fe3-a440-c2cb36960f01","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6179781d-c25b-4fe3-a440-c2cb36960f01","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53902","PortSpecifier":{"PortValue":53902}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361282,"nanos":805075557},"http":{"id":"6179781d-c25b-4fe3-a440-c2cb36960f01","method":"POST","headers":{":authority":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6179781d-c25b-4fe3-a440-c2cb36960f01","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6179781d-c25b-4fe3-a440-c2cb36960f01","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ea29a74d-1b5a-455c-9ed3-8c3252f847ec","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=dc33e7e8-a0e5-40b6-b438-148d57b21a13"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3b111a5ef69a"]}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6179781d-c25b-4fe3-a440-c2cb36960f01","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3b111a5ef69a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=dc33e7e8-a0e5-40b6-b438-148d57b21a13"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ea29a74d-1b5a-455c-9ed3-8c3252f847ec","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"39aeea049f5e28f0dc62955c3e5c128859fe9cbb1b9c85939aa041d12f4c8335"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.85:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6179781d-c25b-4fe3-a440-c2cb36960f01","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6179781d-c25b-4fe3-a440-c2cb36960f01","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6179781d-c25b-4fe3-a440-c2cb36960f01","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6179781d-c25b-4fe3-a440-c2cb36960f01","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6179781d-c25b-4fe3-a440-c2cb36960f01","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6179781d-c25b-4fe3-a440-c2cb36960f01","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6179781d-c25b-4fe3-a440-c2cb36960f01","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6179781d-c25b-4fe3-a440-c2cb36960f01","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38224","PortSpecifier":{"PortValue":38224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.88:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-46bb38.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38224","PortSpecifier":{"PortValue":38224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.88:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361282,"nanos":841816460},"http":{"id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","method":"POST","headers":{":authority":"e2e-shared-b-46bb38.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ea29a74d-1b5a-455c-9ed3-8c3252f847ec","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=dc33e7e8-a0e5-40b6-b438-148d57b21a13"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3b111a5ef69a"]}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3b111a5ef69a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=dc33e7e8-a0e5-40b6-b438-148d57b21a13"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ea29a74d-1b5a-455c-9ed3-8c3252f847ec","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"5ab16578f479fc3f963086d25cee80cbb14007d4d74254304e2620829eea0851"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.88:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-46bb38.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-46bb38/rate-test-model-46bb38\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-46bb38/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e6c2699-e3e6-4fcf-9f1e-a5cc8a61a886","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"069213cf-9892-4035-b624-eddb984039c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53916","PortSpecifier":{"PortValue":53916}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"069213cf-9892-4035-b624-eddb984039c4","method":"POST","path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions","host":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"069213cf-9892-4035-b624-eddb984039c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53916","PortSpecifier":{"PortValue":53916}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361282,"nanos":877619226},"http":{"id":"069213cf-9892-4035-b624-eddb984039c4","method":"POST","headers":{":authority":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"069213cf-9892-4035-b624-eddb984039c4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs"}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"069213cf-9892-4035-b624-eddb984039c4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs\"}"}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"069213cf-9892-4035-b624-eddb984039c4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","subscription":"e2e-rate-iso-a-542dac","tenant":"e2e-shared-a-eb3087","userId":"29d94487-518f-48cf-a1a8-0495827d30d8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"069213cf-9892-4035-b624-eddb984039c4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\",\"requestedSubscription\":\"e2e-rate-iso-a-542dac\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"069213cf-9892-4035-b624-eddb984039c4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"069213cf-9892-4035-b624-eddb984039c4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"069213cf-9892-4035-b624-eddb984039c4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"069213cf-9892-4035-b624-eddb984039c4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"069213cf-9892-4035-b624-eddb984039c4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"069213cf-9892-4035-b624-eddb984039c4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"069213cf-9892-4035-b624-eddb984039c4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"069213cf-9892-4035-b624-eddb984039c4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"069213cf-9892-4035-b624-eddb984039c4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-542dac"}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"069213cf-9892-4035-b624-eddb984039c4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","selected_subscription":"e2e-rate-iso-a-542dac","selected_subscription_key":"ai-tenant-e2e-shared-a-eb3087/e2e-rate-iso-a-542dac@ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"069213cf-9892-4035-b624-eddb984039c4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:41:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"069213cf-9892-4035-b624-eddb984039c4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53918","PortSpecifier":{"PortValue":53918}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ec92026b-c10a-41a3-8719-4c6f343a865e","method":"POST","path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions","host":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53918","PortSpecifier":{"PortValue":53918}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361283,"nanos":916493695},"http":{"id":"ec92026b-c10a-41a3-8719-4c6f343a865e","method":"POST","headers":{":authority":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs"}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs\"}"}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","subscription":"e2e-rate-iso-a-542dac","tenant":"e2e-shared-a-eb3087","userId":"29d94487-518f-48cf-a1a8-0495827d30d8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\",\"requestedSubscription\":\"e2e-rate-iso-a-542dac\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"}}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-542dac"}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","selected_subscription":"e2e-rate-iso-a-542dac","selected_subscription_key":"ai-tenant-e2e-shared-a-eb3087/e2e-rate-iso-a-542dac@ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:41:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec92026b-c10a-41a3-8719-4c6f343a865e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53924","PortSpecifier":{"PortValue":53924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","method":"POST","path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions","host":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53924","PortSpecifier":{"PortValue":53924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361284,"nanos":951248695},"http":{"id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","method":"POST","headers":{":authority":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs"}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs\"}"}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","subscription":"e2e-rate-iso-a-542dac","tenant":"e2e-shared-a-eb3087","userId":"29d94487-518f-48cf-a1a8-0495827d30d8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\",\"requestedSubscription\":\"e2e-rate-iso-a-542dac\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"}}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-542dac"}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","selected_subscription":"e2e-rate-iso-a-542dac","selected_subscription_key":"ai-tenant-e2e-shared-a-eb3087/e2e-rate-iso-a-542dac@ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:41:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b0e331b-3acc-4b88-a0f5-009ca06a5e26","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53940","PortSpecifier":{"PortValue":53940}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d0523dfe-842c-41e3-8460-9887ab31aa54","method":"POST","path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions","host":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53940","PortSpecifier":{"PortValue":53940}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361285,"nanos":989995991},"http":{"id":"d0523dfe-842c-41e3-8460-9887ab31aa54","method":"POST","headers":{":authority":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs"}
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs\"}"}
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","subscription":"e2e-rate-iso-a-542dac","tenant":"e2e-shared-a-eb3087","userId":"29d94487-518f-48cf-a1a8-0495827d30d8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\",\"requestedSubscription\":\"e2e-rate-iso-a-542dac\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"}}
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-542dac"}
{"level":"debug","ts":"2026-07-29T21:41:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:41:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","selected_subscription":"e2e-rate-iso-a-542dac","selected_subscription_key":"ai-tenant-e2e-shared-a-eb3087/e2e-rate-iso-a-542dac@ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T21:41:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:41:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0523dfe-842c-41e3-8460-9887ab31aa54","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52030","PortSpecifier":{"PortValue":52030}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fe334106-8bcb-4772-a8a7-219a17319fed","method":"POST","path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions","host":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52030","PortSpecifier":{"PortValue":52030}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361287,"nanos":31066653},"http":{"id":"fe334106-8bcb-4772-a8a7-219a17319fed","method":"POST","headers":{":authority":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs"}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs\"}"}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","subscription":"e2e-rate-iso-a-542dac","tenant":"e2e-shared-a-eb3087","userId":"29d94487-518f-48cf-a1a8-0495827d30d8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\",\"requestedSubscription\":\"e2e-rate-iso-a-542dac\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"}}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-542dac"}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","selected_subscription":"e2e-rate-iso-a-542dac","selected_subscription_key":"ai-tenant-e2e-shared-a-eb3087/e2e-rate-iso-a-542dac@ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:41:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fe334106-8bcb-4772-a8a7-219a17319fed","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52044","PortSpecifier":{"PortValue":52044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","method":"POST","path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions","host":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52044","PortSpecifier":{"PortValue":52044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361288,"nanos":69086143},"http":{"id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","method":"POST","headers":{":authority":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs"}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs\"}"}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","subscription":"e2e-rate-iso-a-542dac","tenant":"e2e-shared-a-eb3087","userId":"29d94487-518f-48cf-a1a8-0495827d30d8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\",\"requestedSubscription\":\"e2e-rate-iso-a-542dac\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"}}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-542dac"}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","selected_subscription":"e2e-rate-iso-a-542dac","selected_subscription_key":"ai-tenant-e2e-shared-a-eb3087/e2e-rate-iso-a-542dac@ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:41:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e6c3c454-0052-4aec-bfe5-4c51cb1a0a5c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52058","PortSpecifier":{"PortValue":52058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"69c28cd0-cfe1-463c-94ea-368e71b22389","method":"POST","path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions","host":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52058","PortSpecifier":{"PortValue":52058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361289,"nanos":108556503},"http":{"id":"69c28cd0-cfe1-463c-94ea-368e71b22389","method":"POST","headers":{":authority":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs"}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs\"}"}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","subscription":"e2e-rate-iso-a-542dac","tenant":"e2e-shared-a-eb3087","userId":"29d94487-518f-48cf-a1a8-0495827d30d8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\",\"requestedSubscription\":\"e2e-rate-iso-a-542dac\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"}}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-542dac"}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","selected_subscription":"e2e-rate-iso-a-542dac","selected_subscription_key":"ai-tenant-e2e-shared-a-eb3087/e2e-rate-iso-a-542dac@ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:41:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69c28cd0-cfe1-463c-94ea-368e71b22389","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52066","PortSpecifier":{"PortValue":52066}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","method":"POST","path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions","host":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52066","PortSpecifier":{"PortValue":52066}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.85:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361290,"nanos":146052040},"http":{"id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","method":"POST","headers":{":authority":"e2e-shared-a-eb3087.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XHrfiBMfsKwPc3uP_xnKWhadCjU96jJNho6ZNdWfXcCgHHY5E91MwUzgldIs\"}"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","subscription":"e2e-rate-iso-a-542dac","tenant":"e2e-shared-a-eb3087","userId":"29d94487-518f-48cf-a1a8-0495827d30d8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\",\"requestedSubscription\":\"e2e-rate-iso-a-542dac\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-eb3087.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-542dac"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"29d94487-518f-48cf-a1a8-0495827d30d8","keyName":"e2e-rate-a-542dac","selected_subscription":"e2e-rate-iso-a-542dac","selected_subscription_key":"ai-tenant-e2e-shared-a-eb3087/e2e-rate-iso-a-542dac@ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-eb3087/models/facebook/opt-125m","name":"rate-test-model-eb3087","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-542dac","namespace":"ai-tenant-e2e-shared-a-eb3087","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-eb3087/rate-test-model-eb3087"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94b9d545-5ea7-4a92-8f9a-6fa57f24d991","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b625806-0aa5-4876-a603-d356577dad54","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51722","PortSpecifier":{"PortValue":51722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.88:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9b625806-0aa5-4876-a603-d356577dad54","method":"POST","path":"/ai-tenant-e2e-shared-b-46bb38/rate-test-model-46bb38/v1/completions","host":"e2e-shared-b-46bb38.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b625806-0aa5-4876-a603-d356577dad54","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51722","PortSpecifier":{"PortValue":51722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.88:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361290,"nanos":182806240},"http":{"id":"9b625806-0aa5-4876-a603-d356577dad54","method":"POST","headers":{":authority":"e2e-shared-b-46bb38.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-46bb38/rate-test-model-46bb38/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9b625806-0aa5-4876-a603-d356577dad54","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17v2ebhDMV0PGtjl_ViWCZAgCCuwDnUnUblC6bTokQNu2bSwUQ6nh7ORqBO7"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b625806-0aa5-4876-a603-d356577dad54","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-46bb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17v2ebhDMV0PGtjl_ViWCZAgCCuwDnUnUblC6bTokQNu2bSwUQ6nh7ORqBO7\"}"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b625806-0aa5-4876-a603-d356577dad54","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-46bb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4090d528-f045-4b10-8532-00605a1e299a","keyName":"e2e-rate-b-542dac","subscription":"e2e-rate-iso-b-542dac","tenant":"e2e-shared-b-46bb38","userId":"4090d528-f045-4b10-8532-00605a1e299a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b625806-0aa5-4876-a603-d356577dad54","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-46bb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-46bb38/rate-test-model-46bb38\",\"requestedSubscription\":\"e2e-rate-iso-b-542dac\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b625806-0aa5-4876-a603-d356577dad54","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-46bb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-46bb38/models/facebook/opt-125m","name":"rate-test-model-46bb38","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-542dac","namespace":"ai-tenant-e2e-shared-b-46bb38","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-46bb38/rate-test-model-46bb38"}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9b625806-0aa5-4876-a603-d356577dad54","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b625806-0aa5-4876-a603-d356577dad54","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b625806-0aa5-4876-a603-d356577dad54","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b625806-0aa5-4876-a603-d356577dad54","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-46bb38/rate-test-model-46bb38\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-46bb38/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b625806-0aa5-4876-a603-d356577dad54","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b625806-0aa5-4876-a603-d356577dad54","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b625806-0aa5-4876-a603-d356577dad54","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b625806-0aa5-4876-a603-d356577dad54","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-542dac"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b625806-0aa5-4876-a603-d356577dad54","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4090d528-f045-4b10-8532-00605a1e299a","keyName":"e2e-rate-b-542dac","selected_subscription":"e2e-rate-iso-b-542dac","selected_subscription_key":"ai-tenant-e2e-shared-b-46bb38/e2e-rate-iso-b-542dac@ai-tenant-e2e-shared-b-46bb38/rate-test-model-46bb38","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-46bb38/models/facebook/opt-125m","name":"rate-test-model-46bb38","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-542dac","namespace":"ai-tenant-e2e-shared-b-46bb38","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-46bb38/rate-test-model-46bb38"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b625806-0aa5-4876-a603-d356577dad54","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:41:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b625806-0aa5-4876-a603-d356577dad54","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:41:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8f3973ccb2f05ec49201b4d1a2d8583653018d0a0437ee4ed1e91385541819f3"}
{"level":"info","ts":"2026-07-29T21:41:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b6f16fadbf4f0d8bd0649b5337d6edf4ee517351bc05d632c88c8af43bfd2a5c"}
{"level":"info","ts":"2026-07-29T21:41:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/879c43204afe3a7470bc5b4d954cc93905fe729a39130af7d9337aae593fcb66"}
{"level":"info","ts":"2026-07-29T21:41:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/39aeea049f5e28f0dc62955c3e5c128859fe9cbb1b9c85939aa041d12f4c8335"}
{"level":"info","ts":"2026-07-29T21:41:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/08e8cce940906c81dc2a5b2ec10ffac5e149722edd1789ed8f162a114edf3517"}
{"level":"info","ts":"2026-07-29T21:41:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dc69a16e2f8293ac263bf91e37f02212f13b241d5b3363d52180a09b30f0c260"}
{"level":"info","ts":"2026-07-29T21:41:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/89cc65b1c78607a9b8aaddf79cfb08f42ed126bb04fc6d77638775cfe7d0db86"}
{"level":"info","ts":"2026-07-29T21:41:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c27c0ee2bb5716e9b5f62ef2c593efc809f4ac7a356a9b18f6272caa941fa528"}
{"level":"info","ts":"2026-07-29T21:41:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/894535e7210abebdf370c5d0e49ea735f23ee8a348969608ad7909f725bd6d2c"}
{"level":"info","ts":"2026-07-29T21:41:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3ca9cb6b786cc1e29ec314fc838bf7d5fa42dd128af36101b64997877da9d7fb"}
{"level":"info","ts":"2026-07-29T21:41:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e81a636ef1b86e6f3cc2809e3b3bda9b4027d6c71ceef52e4c64011b6c44b95a"}
{"level":"info","ts":"2026-07-29T21:41:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/be4bfb77d6e751f5c0888df7f9a3eefed5f4efc06cc06c3d128932a9aa0e53b7"}
{"level":"info","ts":"2026-07-29T21:41:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5ab16578f479fc3f963086d25cee80cbb14007d4d74254304e2620829eea0851"}
{"level":"info","ts":"2026-07-29T21:41:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ef59b6b7fb9178723b42fc25f02a5a15c171a10f010ec753fe771395fd2e8e15"}
{"level":"info","ts":"2026-07-29T21:41:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c7a5e63ba942e0be4b988d1181dfc654e2c79033d90ba8e6b9af0c12002bc9fa"}
{"level":"info","ts":"2026-07-29T21:41:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/75d597ecd96601def36c0c8bbedbd08f30609d51ca6e6ef03c85463953a426b8"}
{"level":"info","ts":"2026-07-29T21:41:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c0728ee70a70f9ee523a7a2e654817e58fdc46ce192fc0b0bfe2e62acb61316f"}
{"level":"info","ts":"2026-07-29T21:41:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3e847a2e3de2977e80504602707559156aec67696b5ad67d00f2318eebaa3dd3"}
{"level":"info","ts":"2026-07-29T21:41:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d6349a6d2a32e839b1ca773a05b5232ee54665395ec0bf79f32b5b80e2f2ce4d"}
{"level":"info","ts":"2026-07-29T21:41:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b197b9392d340be33df965d7d6342410f8e3885756a6625e172bddaebaadbab1"}
{"level":"info","ts":"2026-07-29T21:41:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/66bb3e2ee9d5ec17f2740a7ec0db45574ff4a4e98eb6adcd37c053f1191ce007"}
{"level":"info","ts":"2026-07-29T21:41:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6a062e0a089d2ba7c7a039570b40b1b88fe87fc19c577c8198941f57bf2edf71"}
{"level":"info","ts":"2026-07-29T21:41:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f9f1ba1982d9bf2690bd6f8e4993dc15d657ea9c5d55c9c65f8aa7377a430c70"}
{"level":"info","ts":"2026-07-29T21:41:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/15ef953ef216f4933fad8cc3cbb69f81ced6423cd098dcba7a97080d80e582cb"}
{"level":"info","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33362","PortSpecifier":{"PortValue":33362}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33362","PortSpecifier":{"PortValue":33362}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361379,"nanos":791401261},"http":{"id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","method":"POST","headers":{":authority":"maas.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ea29a74d-1b5a-455c-9ed3-8c3252f847ec","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=dc33e7e8-a0e5-40b6-b438-148d57b21a13"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3b111a5ef69a"]}}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3b111a5ef69a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=dc33e7e8-a0e5-40b6-b438-148d57b21a13"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ea29a74d-1b5a-455c-9ed3-8c3252f847ec","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.40:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5781101-d2ba-4124-9f95-0e2eb22461c3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"60757c09-a48e-4b64-b972-1af930364fe6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33372","PortSpecifier":{"PortValue":33372}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"60757c09-a48e-4b64-b972-1af930364fe6","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"60757c09-a48e-4b64-b972-1af930364fe6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33372","PortSpecifier":{"PortValue":33372}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361379,"nanos":841491280},"http":{"id":"60757c09-a48e-4b64-b972-1af930364fe6","method":"POST","headers":{":authority":"maas.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"60757c09-a48e-4b64-b972-1af930364fe6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-OtS3DnlzACARVYyu_FTxaYnqmHl7wOSktd50POMD2JJzBTRH9LVCwAg2tW9P"}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"60757c09-a48e-4b64-b972-1af930364fe6","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-OtS3DnlzACARVYyu_FTxaYnqmHl7wOSktd50POMD2JJzBTRH9LVCwAg2tW9P\"}"}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"60757c09-a48e-4b64-b972-1af930364fe6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3de4f407-8c0b-4dbd-b8ec-f83fb0ed23af","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"3de4f407-8c0b-4dbd-b8ec-f83fb0ed23af","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"60757c09-a48e-4b64-b972-1af930364fe6","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"60757c09-a48e-4b64-b972-1af930364fe6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"60757c09-a48e-4b64-b972-1af930364fe6","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.40:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60757c09-a48e-4b64-b972-1af930364fe6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60757c09-a48e-4b64-b972-1af930364fe6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60757c09-a48e-4b64-b972-1af930364fe6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60757c09-a48e-4b64-b972-1af930364fe6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60757c09-a48e-4b64-b972-1af930364fe6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60757c09-a48e-4b64-b972-1af930364fe6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60757c09-a48e-4b64-b972-1af930364fe6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60757c09-a48e-4b64-b972-1af930364fe6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3de4f407-8c0b-4dbd-b8ec-f83fb0ed23af","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"60757c09-a48e-4b64-b972-1af930364fe6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:42:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"60757c09-a48e-4b64-b972-1af930364fe6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4"}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4"}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4"}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4"}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9"}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4"}
{"level":"error","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9"}
{"level":"error","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9"}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9"}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1"}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1"}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"}
{"level":"error","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"452299a484a67ac8b0cadd7cd4bfa39ff539e26d8341ab76eb1a382e6673444e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"452299a484a67ac8b0cadd7cd4bfa39ff539e26d8341ab76eb1a382e6673444e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/452299a484a67ac8b0cadd7cd4bfa39ff539e26d8341ab76eb1a382e6673444e"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"452299a484a67ac8b0cadd7cd4bfa39ff539e26d8341ab76eb1a382e6673444e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"452299a484a67ac8b0cadd7cd4bfa39ff539e26d8341ab76eb1a382e6673444e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/452299a484a67ac8b0cadd7cd4bfa39ff539e26d8341ab76eb1a382e6673444e"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"452299a484a67ac8b0cadd7cd4bfa39ff539e26d8341ab76eb1a382e6673444e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["452299a484a67ac8b0cadd7cd4bfa39ff539e26d8341ab76eb1a382e6673444e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"452299a484a67ac8b0cadd7cd4bfa39ff539e26d8341ab76eb1a382e6673444e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8354caa54f540dbff47e8a7c8d282f19c503e3a8cf47d0e89b9e4003fd558229","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8354caa54f540dbff47e8a7c8d282f19c503e3a8cf47d0e89b9e4003fd558229","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"452299a484a67ac8b0cadd7cd4bfa39ff539e26d8341ab76eb1a382e6673444e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8354caa54f540dbff47e8a7c8d282f19c503e3a8cf47d0e89b9e4003fd558229"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8354caa54f540dbff47e8a7c8d282f19c503e3a8cf47d0e89b9e4003fd558229","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8354caa54f540dbff47e8a7c8d282f19c503e3a8cf47d0e89b9e4003fd558229"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8354caa54f540dbff47e8a7c8d282f19c503e3a8cf47d0e89b9e4003fd558229","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8354caa54f540dbff47e8a7c8d282f19c503e3a8cf47d0e89b9e4003fd558229","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/452299a484a67ac8b0cadd7cd4bfa39ff539e26d8341ab76eb1a382e6673444e"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8354caa54f540dbff47e8a7c8d282f19c503e3a8cf47d0e89b9e4003fd558229"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2"}
{"level":"error","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"627a3b0f2d9d49b9564173f127d4d8d4322b2c868c7b86f2783a46460ffbb543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"627a3b0f2d9d49b9564173f127d4d8d4322b2c868c7b86f2783a46460ffbb543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"627a3b0f2d9d49b9564173f127d4d8d4322b2c868c7b86f2783a46460ffbb543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"627a3b0f2d9d49b9564173f127d4d8d4322b2c868c7b86f2783a46460ffbb543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d43e40245648252be59531e576071e31fcf57bad901d0fc0a73a4f732678a7cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/627a3b0f2d9d49b9564173f127d4d8d4322b2c868c7b86f2783a46460ffbb543"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d43e40245648252be59531e576071e31fcf57bad901d0fc0a73a4f732678a7cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d43e40245648252be59531e576071e31fcf57bad901d0fc0a73a4f732678a7cd"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d43e40245648252be59531e576071e31fcf57bad901d0fc0a73a4f732678a7cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d43e40245648252be59531e576071e31fcf57bad901d0fc0a73a4f732678a7cd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/627a3b0f2d9d49b9564173f127d4d8d4322b2c868c7b86f2783a46460ffbb543"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d43e40245648252be59531e576071e31fcf57bad901d0fc0a73a4f732678a7cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"627a3b0f2d9d49b9564173f127d4d8d4322b2c868c7b86f2783a46460ffbb543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["627a3b0f2d9d49b9564173f127d4d8d4322b2c868c7b86f2783a46460ffbb543"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d43e40245648252be59531e576071e31fcf57bad901d0fc0a73a4f732678a7cd"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"627a3b0f2d9d49b9564173f127d4d8d4322b2c868c7b86f2783a46460ffbb543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d43e40245648252be59531e576071e31fcf57bad901d0fc0a73a4f732678a7cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"627a3b0f2d9d49b9564173f127d4d8d4322b2c868c7b86f2783a46460ffbb543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d43e40245648252be59531e576071e31fcf57bad901d0fc0a73a4f732678a7cd"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/627a3b0f2d9d49b9564173f127d4d8d4322b2c868c7b86f2783a46460ffbb543"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997"}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997"}
{"level":"debug","ts":"2026-07-29T21:43:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0"}
{"level":"info","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T21:43:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T21:43:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997"}
{"level":"info","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997"}
{"level":"info","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997"}
{"level":"debug","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T21:43:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T21:43:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0"}
{"level":"info","ts":"2026-07-29T21:43:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997"}
{"level":"info","ts":"2026-07-29T21:44:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38944","PortSpecifier":{"PortValue":38944}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.96:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-f2f2fe.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:44:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38944","PortSpecifier":{"PortValue":38944}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.96:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361440,"nanos":266484025},"http":{"id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","method":"POST","headers":{":authority":"e2e-ipp-a-f2f2fe.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:44:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T21:44:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ea29a74d-1b5a-455c-9ed3-8c3252f847ec","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=dc33e7e8-a0e5-40b6-b438-148d57b21a13"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3b111a5ef69a"]}}
{"level":"debug","ts":"2026-07-29T21:44:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3b111a5ef69a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=dc33e7e8-a0e5-40b6-b438-148d57b21a13"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ea29a74d-1b5a-455c-9ed3-8c3252f847ec","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.96:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-f2f2fe.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:44:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:44:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:44:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-f2f2fe/ipp-route-f2f2fe\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-f2f2fe/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:44:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T21:44:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:44:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T21:44:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:44:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2e9b2f9e-3a64-4a64-b226-b2c0044fa09f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38948","PortSpecifier":{"PortValue":38948}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.96:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","method":"POST","path":"/ai-tenant-e2e-ipp-a-f2f2fe/ipp-route-f2f2fe/v1/chat/completions","host":"e2e-ipp-a-f2f2fe.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38948","PortSpecifier":{"PortValue":38948}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.96:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785361442,"nanos":330224959},"http":{"id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","method":"POST","headers":{":authority":"e2e-ipp-a-f2f2fe.apps.54470063-d51e-44d1-88c4-3b111a5ef69a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-f2f2fe/ipp-route-f2f2fe/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-7M2OTivEfV7UaDi5_Ai2Tfa99L6c9MtEu7DUEuxbCrykMOBAPejDis7qHQRg"}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-f2f2fe.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-7M2OTivEfV7UaDi5_Ai2Tfa99L6c9MtEu7DUEuxbCrykMOBAPejDis7qHQRg\"}"}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-f2f2fe.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e56a7938-5b75-4a1f-b770-209880005694","keyName":"e2e-ipp-f2f2fe","subscription":"ipp-route-f2f2fe-sub","tenant":"e2e-ipp-a-f2f2fe","userId":"e56a7938-5b75-4a1f-b770-209880005694","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-f2f2fe.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-f2f2fe/ipp-route-f2f2fe\",\"requestedSubscription\":\"ipp-route-f2f2fe-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-f2f2fe.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-f2f2fe/models/facebook/opt-125m","name":"ipp-route-f2f2fe","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-f2f2fe-sub","namespace":"ai-tenant-e2e-ipp-a-f2f2fe","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-f2f2fe/ipp-route-f2f2fe"}}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-f2f2fe/ipp-route-f2f2fe\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-f2f2fe/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-f2f2fe-sub"}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e56a7938-5b75-4a1f-b770-209880005694","keyName":"e2e-ipp-f2f2fe","selected_subscription":"ipp-route-f2f2fe-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-f2f2fe/ipp-route-f2f2fe-sub@ai-tenant-e2e-ipp-a-f2f2fe/ipp-route-f2f2fe","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-f2f2fe/models/facebook/opt-125m","name":"ipp-route-f2f2fe","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-f2f2fe-sub","namespace":"ai-tenant-e2e-ipp-a-f2f2fe","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-f2f2fe/ipp-route-f2f2fe"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T21:44:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"549b74fd-4b6f-4dae-adec-cd5cae5f3d5d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T21:45:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/69ec58fdaaad5c75264e8f31bcdc99f12ee093fb6d48abe2c1809e66051211f2"}
{"level":"info","ts":"2026-07-29T21:45:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b589fa2c400bc93e5187c33a8ed310b32cd09e860b81daf825a090814147b0e1"}
{"level":"info","ts":"2026-07-29T21:45:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/452299a484a67ac8b0cadd7cd4bfa39ff539e26d8341ab76eb1a382e6673444e"}
{"level":"info","ts":"2026-07-29T21:45:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8354caa54f540dbff47e8a7c8d282f19c503e3a8cf47d0e89b9e4003fd558229"}
{"level":"info","ts":"2026-07-29T21:45:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3b850b58845ade2913c894693a642ef6414b35de9e55e5f8cc9436aa94360ef4"}
{"level":"info","ts":"2026-07-29T21:45:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fac400295bc4eeb376812c56c78f81c73aaf3eb85239b337a4d6b7b288628dc0"}
{"level":"info","ts":"2026-07-29T21:45:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7aaf71a4cc3d0915e35d5ceae3f3400a4845937d6d28dc33530259a9435e6d3b"}
{"level":"info","ts":"2026-07-29T21:45:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e307cf54312a244601af84b055c35e822ae16ddf298e3dbb35e6ae7c6bb8db75"}
{"level":"info","ts":"2026-07-29T21:45:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/66a48bfec7f00a8cb6649bc9736e49edfebd7f446918c174abf13878fdf68997"}
{"level":"info","ts":"2026-07-29T21:45:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d43e40245648252be59531e576071e31fcf57bad901d0fc0a73a4f732678a7cd"}
{"level":"info","ts":"2026-07-29T21:45:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/45ae8cc7f36b9a4b35115667dad336f041eed925c1ee0b0c0ce2ec11fe7401d9"}
{"level":"info","ts":"2026-07-29T21:45:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/627a3b0f2d9d49b9564173f127d4d8d4322b2c868c7b86f2783a46460ffbb543"}