--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62387f13b6b0c9a96b4c7e007aca7e91d13d197bd2f44d65a034fa41d8a27300"}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b23587c2224252cbd8c736f73bd4283f22bc028611bd071c52566818f2a99a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62387f13b6b0c9a96b4c7e007aca7e91d13d197bd2f44d65a034fa41d8a27300","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["62387f13b6b0c9a96b4c7e007aca7e91d13d197bd2f44d65a034fa41d8a27300"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62387f13b6b0c9a96b4c7e007aca7e91d13d197bd2f44d65a034fa41d8a27300","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b23587c2224252cbd8c736f73bd4283f22bc028611bd071c52566818f2a99a5"}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e40cfa41b5a8def70cfc9bb4e9356db073cf2c761c21f491827fced975e2c26e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b23587c2224252cbd8c736f73bd4283f22bc028611bd071c52566818f2a99a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62387f13b6b0c9a96b4c7e007aca7e91d13d197bd2f44d65a034fa41d8a27300","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455"}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e40cfa41b5a8def70cfc9bb4e9356db073cf2c761c21f491827fced975e2c26e"}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26d0899021bc10d6889f07a7016cbbc9665857361d10985868f9042313a458cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62387f13b6b0c9a96b4c7e007aca7e91d13d197bd2f44d65a034fa41d8a27300"}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26d0899021bc10d6889f07a7016cbbc9665857361d10985868f9042313a458cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26d0899021bc10d6889f07a7016cbbc9665857361d10985868f9042313a458cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26d0899021bc10d6889f07a7016cbbc9665857361d10985868f9042313a458cf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b23587c2224252cbd8c736f73bd4283f22bc028611bd071c52566818f2a99a5"}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26d0899021bc10d6889f07a7016cbbc9665857361d10985868f9042313a458cf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455"}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26d0899021bc10d6889f07a7016cbbc9665857361d10985868f9042313a458cf"}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26d0899021bc10d6889f07a7016cbbc9665857361d10985868f9042313a458cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["26d0899021bc10d6889f07a7016cbbc9665857361d10985868f9042313a458cf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26d0899021bc10d6889f07a7016cbbc9665857361d10985868f9042313a458cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26d0899021bc10d6889f07a7016cbbc9665857361d10985868f9042313a458cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7"}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26d0899021bc10d6889f07a7016cbbc9665857361d10985868f9042313a458cf"}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7"}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8f0c2bbb48a47421df562600722a7a5b9a5b96839021e3e25a48720ef10cc64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8f0c2bbb48a47421df562600722a7a5b9a5b96839021e3e25a48720ef10cc64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8f0c2bbb48a47421df562600722a7a5b9a5b96839021e3e25a48720ef10cc64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8f0c2bbb48a47421df562600722a7a5b9a5b96839021e3e25a48720ef10cc64","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8f0c2bbb48a47421df562600722a7a5b9a5b96839021e3e25a48720ef10cc64"}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8f0c2bbb48a47421df562600722a7a5b9a5b96839021e3e25a48720ef10cc64","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8f0c2bbb48a47421df562600722a7a5b9a5b96839021e3e25a48720ef10cc64"}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8f0c2bbb48a47421df562600722a7a5b9a5b96839021e3e25a48720ef10cc64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8f0c2bbb48a47421df562600722a7a5b9a5b96839021e3e25a48720ef10cc64"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8f0c2bbb48a47421df562600722a7a5b9a5b96839021e3e25a48720ef10cc64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8f0c2bbb48a47421df562600722a7a5b9a5b96839021e3e25a48720ef10cc64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8f0c2bbb48a47421df562600722a7a5b9a5b96839021e3e25a48720ef10cc64"}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8"}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8"}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd"}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd"}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd"}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8"}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd"}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"info","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"}
{"level":"error","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"error","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"}
{"level":"error","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:09:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"}
{"level":"info","ts":"2026-07-09T14:09:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"info","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52926","PortSpecifier":{"PortValue":52926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52926","PortSpecifier":{"PortValue":52926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606143,"nanos":168936894},"http":{"id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/auth-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8120d6c2-38dd-4b0c-b8af-160f9dcc1ed9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:44228","PortSpecifier":{"PortValue":44228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:44228","PortSpecifier":{"PortValue":44228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606143,"nanos":236440439},"http":{"id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/auth-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7a2e893-884b-4072-939f-575b1ee0e2cf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52928","PortSpecifier":{"PortValue":52928}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","method":"GET","path":"/maas-api/v1/api-keys/0fe6f55e-5c63-46d6-aa72-10c465bf15b2","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52928","PortSpecifier":{"PortValue":52928}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606143,"nanos":324856659},"http":{"id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","method":"GET","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/0fe6f55e-5c63-46d6-aa72-10c465bf15b2",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/0fe6f55e-5c63-46d6-aa72-10c465bf15b2",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/auth-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29b1b4fb-8372-44f7-84be-6d1387a66d19","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"11b89546-5f47-4298-9179-8701a03e16c6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:44230","PortSpecifier":{"PortValue":44230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"11b89546-5f47-4298-9179-8701a03e16c6","method":"GET","path":"/maas-api/v1/api-keys/280364ab-859c-4813-8c3a-d3d5fcb28fa3","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"11b89546-5f47-4298-9179-8701a03e16c6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:44230","PortSpecifier":{"PortValue":44230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606143,"nanos":366862937},"http":{"id":"11b89546-5f47-4298-9179-8701a03e16c6","method":"GET","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/280364ab-859c-4813-8c3a-d3d5fcb28fa3",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"11b89546-5f47-4298-9179-8701a03e16c6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"11b89546-5f47-4298-9179-8701a03e16c6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"11b89546-5f47-4298-9179-8701a03e16c6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/280364ab-859c-4813-8c3a-d3d5fcb28fa3",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"11b89546-5f47-4298-9179-8701a03e16c6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"11b89546-5f47-4298-9179-8701a03e16c6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"11b89546-5f47-4298-9179-8701a03e16c6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/auth-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"11b89546-5f47-4298-9179-8701a03e16c6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"11b89546-5f47-4298-9179-8701a03e16c6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"11b89546-5f47-4298-9179-8701a03e16c6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"11b89546-5f47-4298-9179-8701a03e16c6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:09:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"11b89546-5f47-4298-9179-8701a03e16c6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abbf9ab1-282b-4210-82e4-59564e4646c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47370","PortSpecifier":{"PortValue":47370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"abbf9ab1-282b-4210-82e4-59564e4646c7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abbf9ab1-282b-4210-82e4-59564e4646c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47370","PortSpecifier":{"PortValue":47370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606169,"nanos":792598250},"http":{"id":"abbf9ab1-282b-4210-82e4-59564e4646c7","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"abbf9ab1-282b-4210-82e4-59564e4646c7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"abbf9ab1-282b-4210-82e4-59564e4646c7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"abbf9ab1-282b-4210-82e4-59564e4646c7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abbf9ab1-282b-4210-82e4-59564e4646c7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abbf9ab1-282b-4210-82e4-59564e4646c7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abbf9ab1-282b-4210-82e4-59564e4646c7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/auth-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"abbf9ab1-282b-4210-82e4-59564e4646c7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abbf9ab1-282b-4210-82e4-59564e4646c7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abbf9ab1-282b-4210-82e4-59564e4646c7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abbf9ab1-282b-4210-82e4-59564e4646c7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abbf9ab1-282b-4210-82e4-59564e4646c7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:59436","PortSpecifier":{"PortValue":59436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:59436","PortSpecifier":{"PortValue":59436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606169,"nanos":835073872},"http":{"id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/auth-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b1d422b-d3b5-4761-a1ca-f94dfeeb48be","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47372","PortSpecifier":{"PortValue":47372}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b8f59ccf-f81c-45cd-a845-e22491045cba","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47372","PortSpecifier":{"PortValue":47372}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606169,"nanos":875614289},"http":{"id":"b8f59ccf-f81c-45cd-a845-e22491045cba","method":"GET","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-uyR203f1byy5IqYN_Iy2MwsQ25yv4JyOnoZs94QFwgekb01pM8GpvUJJuO3B"}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-uyR203f1byy5IqYN_Iy2MwsQ25yv4JyOnoZs94QFwgekb01pM8GpvUJJuO3B\"}"}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e0e37af6-05e1-47ed-9036-00c81126f7b6","keyName":"e2e-auth-iso-a-083b76","subscription":"e2e-auth-iso-190a49","tenant":"e2e-shared-a-06548f","userId":"e0e37af6-05e1-47ed-9036-00c81126f7b6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/auth-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-190a49"}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:09:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8f59ccf-f81c-45cd-a845-e22491045cba","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7780e36-9116-4310-810c-344b3d4d7660","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51652","PortSpecifier":{"PortValue":51652}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d7780e36-9116-4310-810c-344b3d4d7660","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7780e36-9116-4310-810c-344b3d4d7660","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51652","PortSpecifier":{"PortValue":51652}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606194,"nanos":239959195},"http":{"id":"d7780e36-9116-4310-810c-344b3d4d7660","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d7780e36-9116-4310-810c-344b3d4d7660","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d7780e36-9116-4310-810c-344b3d4d7660","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d7780e36-9116-4310-810c-344b3d4d7660","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7780e36-9116-4310-810c-344b3d4d7660","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7780e36-9116-4310-810c-344b3d4d7660","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7780e36-9116-4310-810c-344b3d4d7660","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/auth-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d7780e36-9116-4310-810c-344b3d4d7660","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7780e36-9116-4310-810c-344b3d4d7660","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7780e36-9116-4310-810c-344b3d4d7660","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7780e36-9116-4310-810c-344b3d4d7660","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7780e36-9116-4310-810c-344b3d4d7660","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:36730","PortSpecifier":{"PortValue":36730}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:36730","PortSpecifier":{"PortValue":36730}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606194,"nanos":279149128},"http":{"id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/auth-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1cea949-35c9-48f0-910b-6c89f2a81c6a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8984ff09-1210-4e35-8200-97b2b4fa2a85","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:36744","PortSpecifier":{"PortValue":36744}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8984ff09-1210-4e35-8200-97b2b4fa2a85","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8984ff09-1210-4e35-8200-97b2b4fa2a85","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:36744","PortSpecifier":{"PortValue":36744}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606194,"nanos":320342226},"http":{"id":"8984ff09-1210-4e35-8200-97b2b4fa2a85","method":"GET","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8984ff09-1210-4e35-8200-97b2b4fa2a85","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-e4ESTjTJIxwVL9Mt_u9KtL35TP6wYmFxjN7EQzcXJyWhwkDyjLR9KpiQppte"}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8984ff09-1210-4e35-8200-97b2b4fa2a85","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-e4ESTjTJIxwVL9Mt_u9KtL35TP6wYmFxjN7EQzcXJyWhwkDyjLR9KpiQppte\"}"}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8984ff09-1210-4e35-8200-97b2b4fa2a85","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key not found","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8984ff09-1210-4e35-8200-97b2b4fa2a85","input":{"auth":{"identity":"Bearer **** not found","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8984ff09-1210-4e35-8200-97b2b4fa2a85","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"8984ff09-1210-4e35-8200-97b2b4fa2a85","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8984ff09-1210-4e35-8200-97b2b4fa2a85","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T14:09:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8984ff09-1210-4e35-8200-97b2b4fa2a85","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"application/json"},{"x-ext-auth-reason":""}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:50596","PortSpecifier":{"PortValue":50596}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:50596","PortSpecifier":{"PortValue":50596}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606211,"nanos":479449330},"http":{"id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/auth-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f119bc4-2cfb-42e3-bc39-822f3dc24d06","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53360","PortSpecifier":{"PortValue":53360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53360","PortSpecifier":{"PortValue":53360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606211,"nanos":541870944},"http":{"id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/auth-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"506fc1e7-b4f4-4605-b22d-8ee3b5b522a1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1616e02d-49ef-4616-bab8-f44230d0aed3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:50602","PortSpecifier":{"PortValue":50602}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1616e02d-49ef-4616-bab8-f44230d0aed3","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1616e02d-49ef-4616-bab8-f44230d0aed3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:50602","PortSpecifier":{"PortValue":50602}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606211,"nanos":592000663},"http":{"id":"1616e02d-49ef-4616-bab8-f44230d0aed3","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1616e02d-49ef-4616-bab8-f44230d0aed3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1616e02d-49ef-4616-bab8-f44230d0aed3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1616e02d-49ef-4616-bab8-f44230d0aed3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1616e02d-49ef-4616-bab8-f44230d0aed3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1616e02d-49ef-4616-bab8-f44230d0aed3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1616e02d-49ef-4616-bab8-f44230d0aed3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/auth-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1616e02d-49ef-4616-bab8-f44230d0aed3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1616e02d-49ef-4616-bab8-f44230d0aed3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1616e02d-49ef-4616-bab8-f44230d0aed3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1616e02d-49ef-4616-bab8-f44230d0aed3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1616e02d-49ef-4616-bab8-f44230d0aed3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56c1247f-03d9-4c55-862a-8ce2daebac58","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53370","PortSpecifier":{"PortValue":53370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"56c1247f-03d9-4c55-862a-8ce2daebac58","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56c1247f-03d9-4c55-862a-8ce2daebac58","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53370","PortSpecifier":{"PortValue":53370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606211,"nanos":639767328},"http":{"id":"56c1247f-03d9-4c55-862a-8ce2daebac58","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"56c1247f-03d9-4c55-862a-8ce2daebac58","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"56c1247f-03d9-4c55-862a-8ce2daebac58","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"56c1247f-03d9-4c55-862a-8ce2daebac58","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56c1247f-03d9-4c55-862a-8ce2daebac58","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56c1247f-03d9-4c55-862a-8ce2daebac58","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56c1247f-03d9-4c55-862a-8ce2daebac58","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/auth-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"56c1247f-03d9-4c55-862a-8ce2daebac58","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"56c1247f-03d9-4c55-862a-8ce2daebac58","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"56c1247f-03d9-4c55-862a-8ce2daebac58","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56c1247f-03d9-4c55-862a-8ce2daebac58","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:10:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56c1247f-03d9-4c55-862a-8ce2daebac58","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05317c0a-fc7c-4a11-9f45-f482cb952880","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35098","PortSpecifier":{"PortValue":35098}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"05317c0a-fc7c-4a11-9f45-f482cb952880","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05317c0a-fc7c-4a11-9f45-f482cb952880","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35098","PortSpecifier":{"PortValue":35098}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606228,"nanos":811925552},"http":{"id":"05317c0a-fc7c-4a11-9f45-f482cb952880","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"05317c0a-fc7c-4a11-9f45-f482cb952880","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"05317c0a-fc7c-4a11-9f45-f482cb952880","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"05317c0a-fc7c-4a11-9f45-f482cb952880","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05317c0a-fc7c-4a11-9f45-f482cb952880","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05317c0a-fc7c-4a11-9f45-f482cb952880","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05317c0a-fc7c-4a11-9f45-f482cb952880","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/auth-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"05317c0a-fc7c-4a11-9f45-f482cb952880","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05317c0a-fc7c-4a11-9f45-f482cb952880","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05317c0a-fc7c-4a11-9f45-f482cb952880","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05317c0a-fc7c-4a11-9f45-f482cb952880","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05317c0a-fc7c-4a11-9f45-f482cb952880","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25b7730a-e990-4497-b565-d6b60021e2af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:46364","PortSpecifier":{"PortValue":46364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"25b7730a-e990-4497-b565-d6b60021e2af","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25b7730a-e990-4497-b565-d6b60021e2af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:46364","PortSpecifier":{"PortValue":46364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606228,"nanos":849029988},"http":{"id":"25b7730a-e990-4497-b565-d6b60021e2af","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"25b7730a-e990-4497-b565-d6b60021e2af","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"25b7730a-e990-4497-b565-d6b60021e2af","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"25b7730a-e990-4497-b565-d6b60021e2af","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25b7730a-e990-4497-b565-d6b60021e2af","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25b7730a-e990-4497-b565-d6b60021e2af","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25b7730a-e990-4497-b565-d6b60021e2af","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/auth-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"25b7730a-e990-4497-b565-d6b60021e2af","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25b7730a-e990-4497-b565-d6b60021e2af","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25b7730a-e990-4497-b565-d6b60021e2af","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25b7730a-e990-4497-b565-d6b60021e2af","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25b7730a-e990-4497-b565-d6b60021e2af","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"650aa748-d223-4e54-8b1c-7ea323ac1006","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:46368","PortSpecifier":{"PortValue":46368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"650aa748-d223-4e54-8b1c-7ea323ac1006","method":"GET","path":"/maas-api/v1/api-keys/1c89d279-c680-4b7a-8cf1-9229336680ce","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"650aa748-d223-4e54-8b1c-7ea323ac1006","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:46368","PortSpecifier":{"PortValue":46368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606228,"nanos":892862039},"http":{"id":"650aa748-d223-4e54-8b1c-7ea323ac1006","method":"GET","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/1c89d279-c680-4b7a-8cf1-9229336680ce",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"650aa748-d223-4e54-8b1c-7ea323ac1006","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"650aa748-d223-4e54-8b1c-7ea323ac1006","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"650aa748-d223-4e54-8b1c-7ea323ac1006","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/1c89d279-c680-4b7a-8cf1-9229336680ce",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"650aa748-d223-4e54-8b1c-7ea323ac1006","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"650aa748-d223-4e54-8b1c-7ea323ac1006","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"650aa748-d223-4e54-8b1c-7ea323ac1006","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/auth-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"650aa748-d223-4e54-8b1c-7ea323ac1006","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"650aa748-d223-4e54-8b1c-7ea323ac1006","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"650aa748-d223-4e54-8b1c-7ea323ac1006","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"650aa748-d223-4e54-8b1c-7ea323ac1006","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"650aa748-d223-4e54-8b1c-7ea323ac1006","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35100","PortSpecifier":{"PortValue":35100}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","method":"GET","path":"/maas-api/v1/api-keys/1c89d279-c680-4b7a-8cf1-9229336680ce","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35100","PortSpecifier":{"PortValue":35100}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606228,"nanos":925467714},"http":{"id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","method":"GET","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/1c89d279-c680-4b7a-8cf1-9229336680ce",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/1c89d279-c680-4b7a-8cf1-9229336680ce",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/auth-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc659807-c125-42a9-bd69-fcd8e9b2c1ae","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:40178","PortSpecifier":{"PortValue":40178}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:40178","PortSpecifier":{"PortValue":40178}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606255,"nanos":516914620},"http":{"id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/auth-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03a3d626-05fd-4044-933a-a7f8fd625bcf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"adb53885-247f-4710-aa90-52a22573a640","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:50578","PortSpecifier":{"PortValue":50578}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"adb53885-247f-4710-aa90-52a22573a640","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"adb53885-247f-4710-aa90-52a22573a640","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:50578","PortSpecifier":{"PortValue":50578}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606255,"nanos":559014894},"http":{"id":"adb53885-247f-4710-aa90-52a22573a640","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"adb53885-247f-4710-aa90-52a22573a640","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"adb53885-247f-4710-aa90-52a22573a640","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"adb53885-247f-4710-aa90-52a22573a640","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adb53885-247f-4710-aa90-52a22573a640","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adb53885-247f-4710-aa90-52a22573a640","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adb53885-247f-4710-aa90-52a22573a640","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/auth-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"adb53885-247f-4710-aa90-52a22573a640","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adb53885-247f-4710-aa90-52a22573a640","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adb53885-247f-4710-aa90-52a22573a640","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"adb53885-247f-4710-aa90-52a22573a640","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"adb53885-247f-4710-aa90-52a22573a640","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:40190","PortSpecifier":{"PortValue":40190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"33ec74b6-10a0-4b87-a777-e1013f476f21","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:40190","PortSpecifier":{"PortValue":40190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606255,"nanos":603542768},"http":{"id":"33ec74b6-10a0-4b87-a777-e1013f476f21","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-10GeOA0GLFzpWNLya_dfFLSDeHUmWUWx7aOiYlu524h7vAUzX2RJs3Aeby3Ij"}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-10GeOA0GLFzpWNLya_dfFLSDeHUmWUWx7aOiYlu524h7vAUzX2RJs3Aeby3Ij\"}"}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"785a8764-e1bb-4407-b427-29a04ff5b320","keyName":"e2e-auth-iso-a-0a01ae","subscription":"e2e-auth-iso-3ac5ee","tenant":"e2e-shared-a-06548f","userId":"785a8764-e1bb-4407-b427-29a04ff5b320","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/auth-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-3ac5ee"}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:10:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"33ec74b6-10a0-4b87-a777-e1013f476f21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d3457a0f0d8942a099e204f0a901eb5c224b5b861e0dbcf5897cd0b97b5480f1"}
{"level":"info","ts":"2026-07-09T14:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6dd827d7f3bfb1b2e86e10666038473a2bc018c94414ea0cf9f499b05c77c14f"}
{"level":"info","ts":"2026-07-09T14:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/68fe77ca98871597052b83a9a462b6809daebcdb6831578f173eb38261eb12e7"}
{"level":"info","ts":"2026-07-09T14:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/23ddaff5b04aa663695575dcf08e27b69af3e27dbfeeee98635065c08207ab0e"}
{"level":"info","ts":"2026-07-09T14:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/02cc30fd08d4aa199511cbef8309c2f15b5fbda7de2de2318f2875f29a6ad195"}
{"level":"info","ts":"2026-07-09T14:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f75fab939d72b4aec2d7e9157ee77c8e6154015f8134f4d393c246c6572d105a"}
{"level":"info","ts":"2026-07-09T14:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/84cc9b7bd1583257fb72098fd1ef49b1fc1e1a3ed2712e5dcf85153221ce743c"}
{"level":"info","ts":"2026-07-09T14:11:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/df8b5153d27db5f59ca7aedac6985d95229a49953df58291c5ba5876d423d1ca"}
{"level":"info","ts":"2026-07-09T14:11:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e40cfa41b5a8def70cfc9bb4e9356db073cf2c761c21f491827fced975e2c26e"}
{"level":"info","ts":"2026-07-09T14:11:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e8f0c2bbb48a47421df562600722a7a5b9a5b96839021e3e25a48720ef10cc64"}
{"level":"info","ts":"2026-07-09T14:11:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5eecbaa62a3b7fba1f82a28edd31e0e61207b20c1a7b048685f4c1de4b2697b8"}
{"level":"info","ts":"2026-07-09T14:11:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d65d5d5ae8ef44be354215f172aa85e88fe4d952f5292c1fc7ea7ad1e049f0fd"}
{"level":"info","ts":"2026-07-09T14:11:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/62387f13b6b0c9a96b4c7e007aca7e91d13d197bd2f44d65a034fa41d8a27300"}
{"level":"info","ts":"2026-07-09T14:11:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee9cbdeb46876c92efe5076693d67c7eb80dfc8728e8b034785dc98c331f2ea3"}
{"level":"info","ts":"2026-07-09T14:11:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/26d0899021bc10d6889f07a7016cbbc9665857361d10985868f9042313a458cf"}
{"level":"info","ts":"2026-07-09T14:11:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85e99b1faaab0113f8187e37632378fd91888d7afd9804a59fe0dae51a34d98f"}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2"}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2"}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2"}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2"}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2"}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2"}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab"}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab"}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab"}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:11:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab"}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab"}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b"}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004"}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab"}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004"}
{"level":"error","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6cff4a0128d15836a7b42b8a72c33b3a5ac4469e0c1241b36466515bb25af31f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6cff4a0128d15836a7b42b8a72c33b3a5ac4469e0c1241b36466515bb25af31f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6cff4a0128d15836a7b42b8a72c33b3a5ac4469e0c1241b36466515bb25af31f"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6cff4a0128d15836a7b42b8a72c33b3a5ac4469e0c1241b36466515bb25af31f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6cff4a0128d15836a7b42b8a72c33b3a5ac4469e0c1241b36466515bb25af31f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6cff4a0128d15836a7b42b8a72c33b3a5ac4469e0c1241b36466515bb25af31f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6cff4a0128d15836a7b42b8a72c33b3a5ac4469e0c1241b36466515bb25af31f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:11:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6cff4a0128d15836a7b42b8a72c33b3a5ac4469e0c1241b36466515bb25af31f"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2"}
{"level":"info","ts":"2026-07-09T14:11:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871"}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871"}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871"}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe"}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3"}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639"}
{"level":"error","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2"}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7"}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7"}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7"}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed"}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7"}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7"}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85"}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7"}
{"level":"info","ts":"2026-07-09T14:12:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3"}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3"}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6cff4a0128d15836a7b42b8a72c33b3a5ac4469e0c1241b36466515bb25af31f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3"}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6cff4a0128d15836a7b42b8a72c33b3a5ac4469e0c1241b36466515bb25af31f"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe"}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:12:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b23587c2224252cbd8c736f73bd4283f22bc028611bd071c52566818f2a99a5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df6c2afe796757307cf57fb75d5fad679cda1054b0af5ee751e05556af8a4e94","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b23587c2224252cbd8c736f73bd4283f22bc028611bd071c52566818f2a99a5"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df6c2afe796757307cf57fb75d5fad679cda1054b0af5ee751e05556af8a4e94"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2"}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004"}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"info","ts":"2026-07-09T14:12:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab"}
{"level":"info","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6472a31b-1b62-4904-8324-a3a4216d2092","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39938","PortSpecifier":{"PortValue":39938}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6472a31b-1b62-4904-8324-a3a4216d2092","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6472a31b-1b62-4904-8324-a3a4216d2092","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39938","PortSpecifier":{"PortValue":39938}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606376,"nanos":3044825},"http":{"id":"6472a31b-1b62-4904-8324-a3a4216d2092","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6472a31b-1b62-4904-8324-a3a4216d2092","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6472a31b-1b62-4904-8324-a3a4216d2092","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6472a31b-1b62-4904-8324-a3a4216d2092","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6472a31b-1b62-4904-8324-a3a4216d2092","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6472a31b-1b62-4904-8324-a3a4216d2092","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6472a31b-1b62-4904-8324-a3a4216d2092","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/sub-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6472a31b-1b62-4904-8324-a3a4216d2092","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6472a31b-1b62-4904-8324-a3a4216d2092","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6472a31b-1b62-4904-8324-a3a4216d2092","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6472a31b-1b62-4904-8324-a3a4216d2092","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6472a31b-1b62-4904-8324-a3a4216d2092","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef26e6cb-9501-4724-99bd-10cceb103765","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33696","PortSpecifier":{"PortValue":33696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ef26e6cb-9501-4724-99bd-10cceb103765","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef26e6cb-9501-4724-99bd-10cceb103765","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33696","PortSpecifier":{"PortValue":33696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606376,"nanos":56415058},"http":{"id":"ef26e6cb-9501-4724-99bd-10cceb103765","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ef26e6cb-9501-4724-99bd-10cceb103765","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ef26e6cb-9501-4724-99bd-10cceb103765","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ef26e6cb-9501-4724-99bd-10cceb103765","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef26e6cb-9501-4724-99bd-10cceb103765","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef26e6cb-9501-4724-99bd-10cceb103765","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef26e6cb-9501-4724-99bd-10cceb103765","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/sub-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ef26e6cb-9501-4724-99bd-10cceb103765","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef26e6cb-9501-4724-99bd-10cceb103765","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef26e6cb-9501-4724-99bd-10cceb103765","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef26e6cb-9501-4724-99bd-10cceb103765","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef26e6cb-9501-4724-99bd-10cceb103765","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39946","PortSpecifier":{"PortValue":39946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"122d4577-8ce2-438f-84eb-1152cc93f37d","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39946","PortSpecifier":{"PortValue":39946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606376,"nanos":97916450},"http":{"id":"122d4577-8ce2-438f-84eb-1152cc93f37d","method":"GET","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1J8guSiTmrkRPqXNT_P64W34hxrYmPBpfjyzXbqkjov7jPUdwN5cRoTJKSyxq"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1J8guSiTmrkRPqXNT_P64W34hxrYmPBpfjyzXbqkjov7jPUdwN5cRoTJKSyxq\"}"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3bcc274d-dd67-4aeb-8cad-f8f329856ef5","keyName":"e2e-sub-iso-ee080c","subscription":"e2e-a-only-9531ae","tenant":"e2e-shared-a-06548f","userId":"3bcc274d-dd67-4aeb-8cad-f8f329856ef5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/sub-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-a-only-9531ae"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"122d4577-8ce2-438f-84eb-1152cc93f37d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33706","PortSpecifier":{"PortValue":33706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"827ebbc2-df34-4260-89ff-c104602bdd41","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33706","PortSpecifier":{"PortValue":33706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606376,"nanos":148065359},"http":{"id":"827ebbc2-df34-4260-89ff-c104602bdd41","method":"GET","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QFJKVfylw9aLeepE_ea1dQ0cPBk3o5Sar5FDoINd7TTDdAPtjeR0nLtraYXq"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QFJKVfylw9aLeepE_ea1dQ0cPBk3o5Sar5FDoINd7TTDdAPtjeR0nLtraYXq\"}"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e9e4b804-4f60-40f0-b5cf-83a3a6984c4b","keyName":"e2e-sub-iso-fb3024","subscription":"e2e-b-only-9531ae","tenant":"e2e-shared-b-6ee5b0","userId":"e9e4b804-4f60-40f0-b5cf-83a3a6984c4b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/sub-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-b-only-9531ae"}
{"level":"info","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:12:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"827ebbc2-df34-4260-89ff-c104602bdd41","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38440","PortSpecifier":{"PortValue":38440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38440","PortSpecifier":{"PortValue":38440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606395,"nanos":62796496},"http":{"id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/sub-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ee82bf0-805e-400a-b785-0bcd9a6bdf3f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6e28007-3410-412c-904d-378320092d22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51348","PortSpecifier":{"PortValue":51348}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d6e28007-3410-412c-904d-378320092d22","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6e28007-3410-412c-904d-378320092d22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51348","PortSpecifier":{"PortValue":51348}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606395,"nanos":129194500},"http":{"id":"d6e28007-3410-412c-904d-378320092d22","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d6e28007-3410-412c-904d-378320092d22","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d6e28007-3410-412c-904d-378320092d22","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d6e28007-3410-412c-904d-378320092d22","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6e28007-3410-412c-904d-378320092d22","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6e28007-3410-412c-904d-378320092d22","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6e28007-3410-412c-904d-378320092d22","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/sub-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d6e28007-3410-412c-904d-378320092d22","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6e28007-3410-412c-904d-378320092d22","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6e28007-3410-412c-904d-378320092d22","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6e28007-3410-412c-904d-378320092d22","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6e28007-3410-412c-904d-378320092d22","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38448","PortSpecifier":{"PortValue":38448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38448","PortSpecifier":{"PortValue":38448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606395,"nanos":169202325},"http":{"id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-uN4eU5lfnA9zirG2_c7VEuiVFvCZdi1ROhEYD0k5vJIwo9DEPhXuKTdFoY5r"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-uN4eU5lfnA9zirG2_c7VEuiVFvCZdi1ROhEYD0k5vJIwo9DEPhXuKTdFoY5r\"}"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6fe5c173-2222-446f-a7cd-425d918ecae1","keyName":"e2e-sub-iso-1b8ab1","subscription":"e2e-shared-sub-60d338","tenant":"e2e-shared-a-06548f","userId":"6fe5c173-2222-446f-a7cd-425d918ecae1","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/sub-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-60d338"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ec346ad-59c7-4358-8522-4eab1a0f2eaf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cfb01d11-c69e-4036-af52-d11bba783919","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51364","PortSpecifier":{"PortValue":51364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cfb01d11-c69e-4036-af52-d11bba783919","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cfb01d11-c69e-4036-af52-d11bba783919","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:51364","PortSpecifier":{"PortValue":51364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606395,"nanos":202690232},"http":{"id":"cfb01d11-c69e-4036-af52-d11bba783919","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cfb01d11-c69e-4036-af52-d11bba783919","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ErQHG2s7TcYPbaWc_IWGIlmgC8CS0zRZM5Hlun53SMhKr4960TX5xTfvZ0a6"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cfb01d11-c69e-4036-af52-d11bba783919","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ErQHG2s7TcYPbaWc_IWGIlmgC8CS0zRZM5Hlun53SMhKr4960TX5xTfvZ0a6\"}"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cfb01d11-c69e-4036-af52-d11bba783919","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6fb132a6-b315-4ad8-b588-7e157ca0d880","keyName":"e2e-sub-iso-9f1cd1","subscription":"e2e-shared-sub-60d338","tenant":"e2e-shared-b-6ee5b0","userId":"6fb132a6-b315-4ad8-b588-7e157ca0d880","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cfb01d11-c69e-4036-af52-d11bba783919","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfb01d11-c69e-4036-af52-d11bba783919","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfb01d11-c69e-4036-af52-d11bba783919","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfb01d11-c69e-4036-af52-d11bba783919","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/sub-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cfb01d11-c69e-4036-af52-d11bba783919","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfb01d11-c69e-4036-af52-d11bba783919","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfb01d11-c69e-4036-af52-d11bba783919","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-60d338"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfb01d11-c69e-4036-af52-d11bba783919","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cfb01d11-c69e-4036-af52-d11bba783919","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:13:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cfb01d11-c69e-4036-af52-d11bba783919","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:13:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:13:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9"}
{"level":"debug","ts":"2026-07-09T14:13:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:13:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9"}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fad5f166ffe32ff68200d42b80621c900100527f637cee6f839994eebbaf60d5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fad5f166ffe32ff68200d42b80621c900100527f637cee6f839994eebbaf60d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fad5f166ffe32ff68200d42b80621c900100527f637cee6f839994eebbaf60d5"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fad5f166ffe32ff68200d42b80621c900100527f637cee6f839994eebbaf60d5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fad5f166ffe32ff68200d42b80621c900100527f637cee6f839994eebbaf60d5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fad5f166ffe32ff68200d42b80621c900100527f637cee6f839994eebbaf60d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fad5f166ffe32ff68200d42b80621c900100527f637cee6f839994eebbaf60d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fad5f166ffe32ff68200d42b80621c900100527f637cee6f839994eebbaf60d5"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/235ce6e847fc00c60c87b34209d96bc96e57f555799b1f95f9e88ce2cdb5c68a"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3baf68a51da403da4531e5a563c431af0c4f6c5d26073d0f5d9480e63a4da99b"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/626fafa3f6b079d8ebb258fc4e5ee3dacc9a14d2528057e4a8be5f5e27b474b2"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d47b03e78d1bcd9ed48bc297fbc525fa2143eb066d9dbca1b2b98e4dae7254ed"}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:13:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/144a4e29c467bea8c36078be5a99e6a6bbec0818b9bd12dc9d10dd8416468639"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1313d5a85799463e8d68f5e9ffe27afa898b66094ca1bbeddb89098c1595bab3"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b193734ccc37fc43bcaa494758c36e63ad9acc7cf89c033f32b1c3704d683250"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/543add32b674e953c5ba4a6ca8e34b053cd503a23af7364064b2afc8c1c46004"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6cff4a0128d15836a7b42b8a72c33b3a5ac4469e0c1241b36466515bb25af31f"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3975a2ca1227d2cf5ee7f5e34f632c85f43c5272d526d7ef637c439be2298ca2"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4ec13ce65899789bdd556c91d367e745e5cff8ceb46bfa806e82bb687e345b26"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/31c10acf2c11981946b5c46a86ded953210c54222ddf3d17091fd563a07ceb48"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/62a0a2636618c6f89f44ed3b79cb5f1aa4c7d63ac519f2cf2548cc34866be871"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e5e45d5401200e117fb8977a502964527b5b9d627be4dce0d3b075fbb8f408ab"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/39db166d39989d9e73b5df0c7d0a592488b5a0be4b2cb85c4a423e00688e34fe"}
{"level":"info","ts":"2026-07-09T14:13:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5a995b91f816702201790367718dc1cc6b9d65e5ebe74ec3be9da299e746274e"}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb"}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb"}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb"}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915"}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915"}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915"}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915"}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915"}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8"}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8"}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"info","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"}
{"level":"error","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c"}
{"level":"error","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449"}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c"}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915"}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb"}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb"}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449"}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"}
{"level":"error","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b23587c2224252cbd8c736f73bd4283f22bc028611bd071c52566818f2a99a5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c"}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0"}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b23587c2224252cbd8c736f73bd4283f22bc028611bd071c52566818f2a99a5"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df6c2afe796757307cf57fb75d5fad679cda1054b0af5ee751e05556af8a4e94","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fad5f166ffe32ff68200d42b80621c900100527f637cee6f839994eebbaf60d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df6c2afe796757307cf57fb75d5fad679cda1054b0af5ee751e05556af8a4e94"}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106"}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fad5f166ffe32ff68200d42b80621c900100527f637cee6f839994eebbaf60d5"}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T14:14:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7"}
{"level":"debug","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"info","ts":"2026-07-09T14:14:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8"}
{"level":"debug","ts":"2026-07-09T14:14:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T14:14:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T14:14:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9"}
{"level":"info","ts":"2026-07-09T14:14:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455"}
{"level":"info","ts":"2026-07-09T14:14:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85"}
{"level":"info","ts":"2026-07-09T14:14:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"}
{"level":"info","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38074","PortSpecifier":{"PortValue":38074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38074","PortSpecifier":{"PortValue":38074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606499,"nanos":167511932},"http":{"id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:48074","PortSpecifier":{"PortValue":48074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:48074","PortSpecifier":{"PortValue":48074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606499,"nanos":222191255},"http":{"id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38086","PortSpecifier":{"PortValue":38086}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","method":"POST","path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38086","PortSpecifier":{"PortValue":38086}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606499,"nanos":275583122},"http":{"id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dKi6Ev2ahKlecKOw_hL1xQKzLGjRuK1JCPfHwLpQXD0DuZwzAuTsltcSQYU5"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dKi6Ev2ahKlecKOw_hL1xQKzLGjRuK1JCPfHwLpQXD0DuZwzAuTsltcSQYU5\"}"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","keyName":"e2e-rate-a-967fbe","subscription":"e2e-rate-iso-a-967fbe","tenant":"e2e-shared-a-06548f","userId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\",\"requestedSubscription\":\"e2e-rate-iso-a-967fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-967fbe","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-967fbe"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","keyName":"e2e-rate-a-967fbe","selected_subscription":"e2e-rate-iso-a-967fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-06548f/e2e-rate-iso-a-967fbe@ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-967fbe","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38102","PortSpecifier":{"PortValue":38102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","method":"POST","path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38102","PortSpecifier":{"PortValue":38102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606500,"nanos":336844676},"http":{"id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dKi6Ev2ahKlecKOw_hL1xQKzLGjRuK1JCPfHwLpQXD0DuZwzAuTsltcSQYU5"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dKi6Ev2ahKlecKOw_hL1xQKzLGjRuK1JCPfHwLpQXD0DuZwzAuTsltcSQYU5\"}"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","keyName":"e2e-rate-a-967fbe","subscription":"e2e-rate-iso-a-967fbe","tenant":"e2e-shared-a-06548f","userId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\",\"requestedSubscription\":\"e2e-rate-iso-a-967fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-967fbe","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-967fbe"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","keyName":"e2e-rate-a-967fbe","selected_subscription":"e2e-rate-iso-a-967fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-06548f/e2e-rate-iso-a-967fbe@ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-967fbe","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36b5c57b-724b-4841-859f-aa16e4954205","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38112","PortSpecifier":{"PortValue":38112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"36b5c57b-724b-4841-859f-aa16e4954205","method":"POST","path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36b5c57b-724b-4841-859f-aa16e4954205","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38112","PortSpecifier":{"PortValue":38112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606501,"nanos":377753971},"http":{"id":"36b5c57b-724b-4841-859f-aa16e4954205","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dKi6Ev2ahKlecKOw_hL1xQKzLGjRuK1JCPfHwLpQXD0DuZwzAuTsltcSQYU5"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dKi6Ev2ahKlecKOw_hL1xQKzLGjRuK1JCPfHwLpQXD0DuZwzAuTsltcSQYU5\"}"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","keyName":"e2e-rate-a-967fbe","subscription":"e2e-rate-iso-a-967fbe","tenant":"e2e-shared-a-06548f","userId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\",\"requestedSubscription\":\"e2e-rate-iso-a-967fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-967fbe","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"36b5c57b-724b-4841-859f-aa16e4954205","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-967fbe"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","keyName":"e2e-rate-a-967fbe","selected_subscription":"e2e-rate-iso-a-967fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-06548f/e2e-rate-iso-a-967fbe@ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-967fbe","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36b5c57b-724b-4841-859f-aa16e4954205","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36b5c57b-724b-4841-859f-aa16e4954205","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56006","PortSpecifier":{"PortValue":56006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1ae45640-416a-4d77-84e9-74bbfb345f32","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56006","PortSpecifier":{"PortValue":56006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606514,"nanos":399749091},"http":{"id":"1ae45640-416a-4d77-84e9-74bbfb345f32","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35792","PortSpecifier":{"PortValue":35792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35792","PortSpecifier":{"PortValue":35792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606514,"nanos":446838727},"http":{"id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56022","PortSpecifier":{"PortValue":56022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"903a1903-2554-49e3-8687-7e7dc43a580a","method":"POST","path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56022","PortSpecifier":{"PortValue":56022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606514,"nanos":485178594},"http":{"id":"903a1903-2554-49e3-8687-7e7dc43a580a","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IisFKniG0l5wVF85_MYh2InE7WcEBd6x0r98D1PrQUCaAdOydGJ9VUyYbiiQ"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IisFKniG0l5wVF85_MYh2InE7WcEBd6x0r98D1PrQUCaAdOydGJ9VUyYbiiQ\"}"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"28bc7775-fcea-49da-a981-cddb43ff2b69","keyName":"e2e-rate-a-d28351","subscription":"e2e-rate-iso-a-d28351","tenant":"e2e-shared-a-06548f","userId":"28bc7775-fcea-49da-a981-cddb43ff2b69","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\",\"requestedSubscription\":\"e2e-rate-iso-a-d28351\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d28351","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d28351"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"28bc7775-fcea-49da-a981-cddb43ff2b69","keyName":"e2e-rate-a-d28351","selected_subscription":"e2e-rate-iso-a-d28351","selected_subscription_key":"ai-tenant-e2e-shared-a-06548f/e2e-rate-iso-a-d28351@ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d28351","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56036","PortSpecifier":{"PortValue":56036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"14efb549-32c2-4491-9ce0-963a2fcc4439","method":"POST","path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56036","PortSpecifier":{"PortValue":56036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606515,"nanos":521772951},"http":{"id":"14efb549-32c2-4491-9ce0-963a2fcc4439","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IisFKniG0l5wVF85_MYh2InE7WcEBd6x0r98D1PrQUCaAdOydGJ9VUyYbiiQ"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IisFKniG0l5wVF85_MYh2InE7WcEBd6x0r98D1PrQUCaAdOydGJ9VUyYbiiQ\"}"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"28bc7775-fcea-49da-a981-cddb43ff2b69","keyName":"e2e-rate-a-d28351","subscription":"e2e-rate-iso-a-d28351","tenant":"e2e-shared-a-06548f","userId":"28bc7775-fcea-49da-a981-cddb43ff2b69","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\",\"requestedSubscription\":\"e2e-rate-iso-a-d28351\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d28351","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d28351"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"28bc7775-fcea-49da-a981-cddb43ff2b69","keyName":"e2e-rate-a-d28351","selected_subscription":"e2e-rate-iso-a-d28351","selected_subscription_key":"ai-tenant-e2e-shared-a-06548f/e2e-rate-iso-a-d28351@ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d28351","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56046","PortSpecifier":{"PortValue":56046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","method":"POST","path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56046","PortSpecifier":{"PortValue":56046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606516,"nanos":568610979},"http":{"id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IisFKniG0l5wVF85_MYh2InE7WcEBd6x0r98D1PrQUCaAdOydGJ9VUyYbiiQ"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IisFKniG0l5wVF85_MYh2InE7WcEBd6x0r98D1PrQUCaAdOydGJ9VUyYbiiQ\"}"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"28bc7775-fcea-49da-a981-cddb43ff2b69","keyName":"e2e-rate-a-d28351","subscription":"e2e-rate-iso-a-d28351","tenant":"e2e-shared-a-06548f","userId":"28bc7775-fcea-49da-a981-cddb43ff2b69","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\",\"requestedSubscription\":\"e2e-rate-iso-a-d28351\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d28351","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d28351"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"28bc7775-fcea-49da-a981-cddb43ff2b69","keyName":"e2e-rate-a-d28351","selected_subscription":"e2e-rate-iso-a-d28351","selected_subscription_key":"ai-tenant-e2e-shared-a-06548f/e2e-rate-iso-a-d28351@ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d28351","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35800","PortSpecifier":{"PortValue":35800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","method":"POST","path":"/ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0/v1/completions","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35800","PortSpecifier":{"PortValue":35800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606516,"nanos":614274600},"http":{"id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17DGEXG6rxyS7yykK_MeqvPZ2invQMjqhlJthw3NyLbATujiIRQMNuNvxVnjr"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17DGEXG6rxyS7yykK_MeqvPZ2invQMjqhlJthw3NyLbATujiIRQMNuNvxVnjr\"}"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9edb852d-77bd-4d1d-8d11-1e96165d6566","keyName":"e2e-rate-b-d28351","subscription":"e2e-rate-iso-b-d28351","tenant":"e2e-shared-b-6ee5b0","userId":"9edb852d-77bd-4d1d-8d11-1e96165d6566","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0\",\"requestedSubscription\":\"e2e-rate-iso-b-d28351\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6ee5b0","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d28351","namespace":"ai-tenant-e2e-shared-b-6ee5b0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-d28351"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9edb852d-77bd-4d1d-8d11-1e96165d6566","keyName":"e2e-rate-b-d28351","selected_subscription":"e2e-rate-iso-b-d28351","selected_subscription_key":"ai-tenant-e2e-shared-b-6ee5b0/e2e-rate-iso-b-d28351@ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6ee5b0","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d28351","namespace":"ai-tenant-e2e-shared-b-6ee5b0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34710","PortSpecifier":{"PortValue":34710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34710","PortSpecifier":{"PortValue":34710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":546317876},"http":{"id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","method":"POST","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34722","PortSpecifier":{"PortValue":34722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34722","PortSpecifier":{"PortValue":34722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":597845290},"http":{"id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","method":"POST","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34734","PortSpecifier":{"PortValue":34734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34734","PortSpecifier":{"PortValue":34734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":636180553},"http":{"id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","method":"POST","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34738","PortSpecifier":{"PortValue":34738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"116296c0-feaf-43ca-84a5-dadd00b02127","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34738","PortSpecifier":{"PortValue":34738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":675474517},"http":{"id":"116296c0-feaf-43ca-84a5-dadd00b02127","method":"POST","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34754","PortSpecifier":{"PortValue":34754}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34754","PortSpecifier":{"PortValue":34754}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":708274053},"http":{"id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"88efe84a-44d0-4fd6-a699-0b4af2b129eb","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"88efe84a-44d0-4fd6-a699-0b4af2b129eb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fad5f166ffe32ff68200d42b80621c900100527f637cee6f839994eebbaf60d5"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6df099b7-ed9a-41b8-bca6-585cf6876525","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":733860906},"http":{"id":"6df099b7-ed9a-41b8-bca6-585cf6876525","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"88efe84a-44d0-4fd6-a699-0b4af2b129eb","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"88efe84a-44d0-4fd6-a699-0b4af2b129eb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.56","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctMjJnNGcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.33~maas-default-gateway-openshift-default-56654dcf7-22g4g.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.56","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"6df099b7-ed9a-41b8-bca6-585cf6876525"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6df099b7-ed9a-41b8-bca6-585cf6876525","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":733860906,"seconds":1783606524},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.56:34796","port":34796}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"88efe84a-44d0-4fd6-a699-0b4af2b129eb","keyName":"e2e-revoketest-a-0","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34766","PortSpecifier":{"PortValue":34766}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34766","PortSpecifier":{"PortValue":34766}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":768331845},"http":{"id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"60ceedad-edc6-4cf0-9f3f-54e70b95a1a0","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"60ceedad-edc6-4cf0-9f3f-54e70b95a1a0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"073fd559-6206-4583-81f6-6ee39e6cca47","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":777130944},"http":{"id":"073fd559-6206-4583-81f6-6ee39e6cca47","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"60ceedad-edc6-4cf0-9f3f-54e70b95a1a0","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"60ceedad-edc6-4cf0-9f3f-54e70b95a1a0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.56","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctMjJnNGcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.33~maas-default-gateway-openshift-default-56654dcf7-22g4g.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.56","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"073fd559-6206-4583-81f6-6ee39e6cca47"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"073fd559-6206-4583-81f6-6ee39e6cca47","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":777130944,"seconds":1783606524},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.56:34796","port":34796}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"60ceedad-edc6-4cf0-9f3f-54e70b95a1a0","keyName":"e2e-revoketest-a-1","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34778","PortSpecifier":{"PortValue":34778}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34778","PortSpecifier":{"PortValue":34778}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":814839527},"http":{"id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71d888ac-623a-42ce-adda-587af4709f5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"71d888ac-623a-42ce-adda-587af4709f5d","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71d888ac-623a-42ce-adda-587af4709f5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":822500756},"http":{"id":"71d888ac-623a-42ce-adda-587af4709f5d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"71d888ac-623a-42ce-adda-587af4709f5d","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.56","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctMjJnNGcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.33~maas-default-gateway-openshift-default-56654dcf7-22g4g.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.56","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"71d888ac-623a-42ce-adda-587af4709f5d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"71d888ac-623a-42ce-adda-587af4709f5d","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":822500756,"seconds":1783606524},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.56:34796","port":34796}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71d888ac-623a-42ce-adda-587af4709f5d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71d888ac-623a-42ce-adda-587af4709f5d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34780","PortSpecifier":{"PortValue":34780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"460f925a-8502-4e36-ad22-a0d504ff55e7","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34780","PortSpecifier":{"PortValue":34780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":854883350},"http":{"id":"460f925a-8502-4e36-ad22-a0d504ff55e7","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02d32087-6202-4f33-b764-a0222e01104e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"02d32087-6202-4f33-b764-a0222e01104e","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02d32087-6202-4f33-b764-a0222e01104e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":862773145},"http":{"id":"02d32087-6202-4f33-b764-a0222e01104e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"02d32087-6202-4f33-b764-a0222e01104e","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.56","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctMjJnNGcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.33~maas-default-gateway-openshift-default-56654dcf7-22g4g.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.56","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"02d32087-6202-4f33-b764-a0222e01104e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"02d32087-6202-4f33-b764-a0222e01104e","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":862773145,"seconds":1783606524},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.56:34796","port":34796}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02d32087-6202-4f33-b764-a0222e01104e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02d32087-6202-4f33-b764-a0222e01104e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34792","PortSpecifier":{"PortValue":34792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2306f406-60fa-4b30-b5fb-1e1017c09421","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34792","PortSpecifier":{"PortValue":34792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":134852060},"http":{"id":"2306f406-60fa-4b30-b5fb-1e1017c09421","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"x-ext-auth-reason":""},{"content-type":"application/json"}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":167717730},"http":{"id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"x-ext-auth-reason":""},{"content-type":"application/json"}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34810","PortSpecifier":{"PortValue":34810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aaa70851-75c4-441c-b106-fe3d367673ec","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34810","PortSpecifier":{"PortValue":34810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":198133621},"http":{"id":"aaa70851-75c4-441c-b106-fe3d367673ec","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":206044419},"http":{"id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.56","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctMjJnNGcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.33~maas-default-gateway-openshift-default-56654dcf7-22g4g.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.56","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"40750dbc-1df6-44f1-a252-b0b58bed08cb"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":206044419,"seconds":1783606529},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.56:34796","port":34796}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34814","PortSpecifier":{"PortValue":34814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34814","PortSpecifier":{"PortValue":34814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":239429945},"http":{"id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"024dd07e-8c11-49b5-8d02-f59972aeb599","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":247331009},"http":{"id":"024dd07e-8c11-49b5-8d02-f59972aeb599","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.56","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctMjJnNGcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.33~maas-default-gateway-openshift-default-56654dcf7-22g4g.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.56","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"024dd07e-8c11-49b5-8d02-f59972aeb599"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"024dd07e-8c11-49b5-8d02-f59972aeb599","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":247331009,"seconds":1783606529},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.56:34796","port":34796}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34830","PortSpecifier":{"PortValue":34830}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","method":"DELETE","path":"/maas-api/v1/api-keys/059c1248-c4c9-471a-94aa-bc4d69a1d867","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34830","PortSpecifier":{"PortValue":34830}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":282983700},"http":{"id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","method":"DELETE","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/059c1248-c4c9-471a-94aa-bc4d69a1d867",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/059c1248-c4c9-471a-94aa-bc4d69a1d867",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"691269ae-392d-458a-83d4-0996b8475693","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34836","PortSpecifier":{"PortValue":34836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"691269ae-392d-458a-83d4-0996b8475693","method":"DELETE","path":"/maas-api/v1/api-keys/c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"691269ae-392d-458a-83d4-0996b8475693","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34836","PortSpecifier":{"PortValue":34836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":317102667},"http":{"id":"691269ae-392d-458a-83d4-0996b8475693","method":"DELETE","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c1941a0c-1c9d-4c52-bceb-a33f4a4c146c",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"691269ae-392d-458a-83d4-0996b8475693","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"691269ae-392d-458a-83d4-0996b8475693","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c1941a0c-1c9d-4c52-bceb-a33f4a4c146c",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"691269ae-392d-458a-83d4-0996b8475693","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"691269ae-392d-458a-83d4-0996b8475693","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:16:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/df6c2afe796757307cf57fb75d5fad679cda1054b0af5ee751e05556af8a4e94"}
{"level":"info","ts":"2026-07-09T14:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85"}
{"level":"info","ts":"2026-07-09T14:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"}
{"level":"info","ts":"2026-07-09T14:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7"}