{"level":"info","ts":"2026-07-09T14:14:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85"}
{"level":"info","ts":"2026-07-09T14:14:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"}
{"level":"info","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38074","PortSpecifier":{"PortValue":38074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38074","PortSpecifier":{"PortValue":38074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606499,"nanos":167511932},"http":{"id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eadfccf5-b66e-465d-bda1-da0475fd2bc2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:48074","PortSpecifier":{"PortValue":48074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:48074","PortSpecifier":{"PortValue":48074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606499,"nanos":222191255},"http":{"id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec5fd485-47fd-4043-a6d9-a8623cb83c37","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38086","PortSpecifier":{"PortValue":38086}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","method":"POST","path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38086","PortSpecifier":{"PortValue":38086}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606499,"nanos":275583122},"http":{"id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dKi6Ev2ahKlecKOw_hL1xQKzLGjRuK1JCPfHwLpQXD0DuZwzAuTsltcSQYU5"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dKi6Ev2ahKlecKOw_hL1xQKzLGjRuK1JCPfHwLpQXD0DuZwzAuTsltcSQYU5\"}"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","keyName":"e2e-rate-a-967fbe","subscription":"e2e-rate-iso-a-967fbe","tenant":"e2e-shared-a-06548f","userId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\",\"requestedSubscription\":\"e2e-rate-iso-a-967fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-967fbe","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-967fbe"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","keyName":"e2e-rate-a-967fbe","selected_subscription":"e2e-rate-iso-a-967fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-06548f/e2e-rate-iso-a-967fbe@ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-967fbe","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:14:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"320ee782-6ad3-4481-9ba5-394f3fceeb9d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38102","PortSpecifier":{"PortValue":38102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","method":"POST","path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38102","PortSpecifier":{"PortValue":38102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606500,"nanos":336844676},"http":{"id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dKi6Ev2ahKlecKOw_hL1xQKzLGjRuK1JCPfHwLpQXD0DuZwzAuTsltcSQYU5"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dKi6Ev2ahKlecKOw_hL1xQKzLGjRuK1JCPfHwLpQXD0DuZwzAuTsltcSQYU5\"}"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","keyName":"e2e-rate-a-967fbe","subscription":"e2e-rate-iso-a-967fbe","tenant":"e2e-shared-a-06548f","userId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\",\"requestedSubscription\":\"e2e-rate-iso-a-967fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-967fbe","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-967fbe"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","keyName":"e2e-rate-a-967fbe","selected_subscription":"e2e-rate-iso-a-967fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-06548f/e2e-rate-iso-a-967fbe@ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-967fbe","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4da1aba3-2535-4be1-8bc7-16dd56d38d7e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36b5c57b-724b-4841-859f-aa16e4954205","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38112","PortSpecifier":{"PortValue":38112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"36b5c57b-724b-4841-859f-aa16e4954205","method":"POST","path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36b5c57b-724b-4841-859f-aa16e4954205","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38112","PortSpecifier":{"PortValue":38112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606501,"nanos":377753971},"http":{"id":"36b5c57b-724b-4841-859f-aa16e4954205","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dKi6Ev2ahKlecKOw_hL1xQKzLGjRuK1JCPfHwLpQXD0DuZwzAuTsltcSQYU5"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dKi6Ev2ahKlecKOw_hL1xQKzLGjRuK1JCPfHwLpQXD0DuZwzAuTsltcSQYU5\"}"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","keyName":"e2e-rate-a-967fbe","subscription":"e2e-rate-iso-a-967fbe","tenant":"e2e-shared-a-06548f","userId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\",\"requestedSubscription\":\"e2e-rate-iso-a-967fbe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-967fbe","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"36b5c57b-724b-4841-859f-aa16e4954205","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-967fbe"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36b5c57b-724b-4841-859f-aa16e4954205","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a18621fb-5a2b-4dbf-8465-aaaec095e176","keyName":"e2e-rate-a-967fbe","selected_subscription":"e2e-rate-iso-a-967fbe","selected_subscription_key":"ai-tenant-e2e-shared-a-06548f/e2e-rate-iso-a-967fbe@ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-967fbe","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36b5c57b-724b-4841-859f-aa16e4954205","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36b5c57b-724b-4841-859f-aa16e4954205","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56006","PortSpecifier":{"PortValue":56006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1ae45640-416a-4d77-84e9-74bbfb345f32","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56006","PortSpecifier":{"PortValue":56006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606514,"nanos":399749091},"http":{"id":"1ae45640-416a-4d77-84e9-74bbfb345f32","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ae45640-416a-4d77-84e9-74bbfb345f32","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35792","PortSpecifier":{"PortValue":35792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35792","PortSpecifier":{"PortValue":35792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606514,"nanos":446838727},"http":{"id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1689140a-0818-47e6-b8ac-ddc2ed5295a0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56022","PortSpecifier":{"PortValue":56022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"903a1903-2554-49e3-8687-7e7dc43a580a","method":"POST","path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56022","PortSpecifier":{"PortValue":56022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606514,"nanos":485178594},"http":{"id":"903a1903-2554-49e3-8687-7e7dc43a580a","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IisFKniG0l5wVF85_MYh2InE7WcEBd6x0r98D1PrQUCaAdOydGJ9VUyYbiiQ"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IisFKniG0l5wVF85_MYh2InE7WcEBd6x0r98D1PrQUCaAdOydGJ9VUyYbiiQ\"}"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"28bc7775-fcea-49da-a981-cddb43ff2b69","keyName":"e2e-rate-a-d28351","subscription":"e2e-rate-iso-a-d28351","tenant":"e2e-shared-a-06548f","userId":"28bc7775-fcea-49da-a981-cddb43ff2b69","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\",\"requestedSubscription\":\"e2e-rate-iso-a-d28351\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d28351","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d28351"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"28bc7775-fcea-49da-a981-cddb43ff2b69","keyName":"e2e-rate-a-d28351","selected_subscription":"e2e-rate-iso-a-d28351","selected_subscription_key":"ai-tenant-e2e-shared-a-06548f/e2e-rate-iso-a-d28351@ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d28351","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"903a1903-2554-49e3-8687-7e7dc43a580a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56036","PortSpecifier":{"PortValue":56036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"14efb549-32c2-4491-9ce0-963a2fcc4439","method":"POST","path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56036","PortSpecifier":{"PortValue":56036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606515,"nanos":521772951},"http":{"id":"14efb549-32c2-4491-9ce0-963a2fcc4439","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IisFKniG0l5wVF85_MYh2InE7WcEBd6x0r98D1PrQUCaAdOydGJ9VUyYbiiQ"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IisFKniG0l5wVF85_MYh2InE7WcEBd6x0r98D1PrQUCaAdOydGJ9VUyYbiiQ\"}"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"28bc7775-fcea-49da-a981-cddb43ff2b69","keyName":"e2e-rate-a-d28351","subscription":"e2e-rate-iso-a-d28351","tenant":"e2e-shared-a-06548f","userId":"28bc7775-fcea-49da-a981-cddb43ff2b69","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\",\"requestedSubscription\":\"e2e-rate-iso-a-d28351\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d28351","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d28351"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"28bc7775-fcea-49da-a981-cddb43ff2b69","keyName":"e2e-rate-a-d28351","selected_subscription":"e2e-rate-iso-a-d28351","selected_subscription_key":"ai-tenant-e2e-shared-a-06548f/e2e-rate-iso-a-d28351@ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d28351","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"14efb549-32c2-4491-9ce0-963a2fcc4439","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56046","PortSpecifier":{"PortValue":56046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","method":"POST","path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions","host":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:56046","PortSpecifier":{"PortValue":56046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606516,"nanos":568610979},"http":{"id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","method":"POST","headers":{":authority":"e2e-shared-a-06548f.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IisFKniG0l5wVF85_MYh2InE7WcEBd6x0r98D1PrQUCaAdOydGJ9VUyYbiiQ"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IisFKniG0l5wVF85_MYh2InE7WcEBd6x0r98D1PrQUCaAdOydGJ9VUyYbiiQ\"}"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"28bc7775-fcea-49da-a981-cddb43ff2b69","keyName":"e2e-rate-a-d28351","subscription":"e2e-rate-iso-a-d28351","tenant":"e2e-shared-a-06548f","userId":"28bc7775-fcea-49da-a981-cddb43ff2b69","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\",\"requestedSubscription\":\"e2e-rate-iso-a-d28351\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-06548f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d28351","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d28351"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"28bc7775-fcea-49da-a981-cddb43ff2b69","keyName":"e2e-rate-a-d28351","selected_subscription":"e2e-rate-iso-a-d28351","selected_subscription_key":"ai-tenant-e2e-shared-a-06548f/e2e-rate-iso-a-d28351@ai-tenant-e2e-shared-a-06548f/rate-test-model-06548f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-06548f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d28351","namespace":"ai-tenant-e2e-shared-a-06548f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b290cf33-1d12-4d4f-8f64-69094ad983e8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35800","PortSpecifier":{"PortValue":35800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","method":"POST","path":"/ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0/v1/completions","host":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35800","PortSpecifier":{"PortValue":35800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606516,"nanos":614274600},"http":{"id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","method":"POST","headers":{":authority":"e2e-shared-b-6ee5b0.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17DGEXG6rxyS7yykK_MeqvPZ2invQMjqhlJthw3NyLbATujiIRQMNuNvxVnjr"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17DGEXG6rxyS7yykK_MeqvPZ2invQMjqhlJthw3NyLbATujiIRQMNuNvxVnjr\"}"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9edb852d-77bd-4d1d-8d11-1e96165d6566","keyName":"e2e-rate-b-d28351","subscription":"e2e-rate-iso-b-d28351","tenant":"e2e-shared-b-6ee5b0","userId":"9edb852d-77bd-4d1d-8d11-1e96165d6566","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0\",\"requestedSubscription\":\"e2e-rate-iso-b-d28351\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-6ee5b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-6ee5b0","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d28351","namespace":"ai-tenant-e2e-shared-b-6ee5b0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-d28351"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9edb852d-77bd-4d1d-8d11-1e96165d6566","keyName":"e2e-rate-b-d28351","selected_subscription":"e2e-rate-iso-b-d28351","selected_subscription_key":"ai-tenant-e2e-shared-b-6ee5b0/e2e-rate-iso-b-d28351@ai-tenant-e2e-shared-b-6ee5b0/rate-test-model-6ee5b0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-6ee5b0","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-d28351","namespace":"ai-tenant-e2e-shared-b-6ee5b0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8f97997-2e0d-4cec-8cc7-ed5638583827","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34710","PortSpecifier":{"PortValue":34710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34710","PortSpecifier":{"PortValue":34710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":546317876},"http":{"id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","method":"POST","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce9558b0-8679-420a-aeef-fe73b0850ee8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34722","PortSpecifier":{"PortValue":34722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34722","PortSpecifier":{"PortValue":34722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":597845290},"http":{"id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","method":"POST","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2fd273b5-9034-48d1-a281-afbe2607a0ac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34734","PortSpecifier":{"PortValue":34734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34734","PortSpecifier":{"PortValue":34734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":636180553},"http":{"id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","method":"POST","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ccb3f1d2-211e-45ff-b2b7-545f57173015","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34738","PortSpecifier":{"PortValue":34738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"116296c0-feaf-43ca-84a5-dadd00b02127","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34738","PortSpecifier":{"PortValue":34738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":675474517},"http":{"id":"116296c0-feaf-43ca-84a5-dadd00b02127","method":"POST","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"116296c0-feaf-43ca-84a5-dadd00b02127","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34754","PortSpecifier":{"PortValue":34754}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34754","PortSpecifier":{"PortValue":34754}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":708274053},"http":{"id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"88efe84a-44d0-4fd6-a699-0b4af2b129eb","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"88efe84a-44d0-4fd6-a699-0b4af2b129eb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05ae71ed-df8c-41a0-83d8-4a0639888fd9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fad5f166ffe32ff68200d42b80621c900100527f637cee6f839994eebbaf60d5"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6df099b7-ed9a-41b8-bca6-585cf6876525","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":733860906},"http":{"id":"6df099b7-ed9a-41b8-bca6-585cf6876525","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"88efe84a-44d0-4fd6-a699-0b4af2b129eb","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"88efe84a-44d0-4fd6-a699-0b4af2b129eb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.56","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctMjJnNGcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.33~maas-default-gateway-openshift-default-56654dcf7-22g4g.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.56","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"6df099b7-ed9a-41b8-bca6-585cf6876525"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6df099b7-ed9a-41b8-bca6-585cf6876525","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":733860906,"seconds":1783606524},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.56:34796","port":34796}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"88efe84a-44d0-4fd6-a699-0b4af2b129eb","keyName":"e2e-revoketest-a-0","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6df099b7-ed9a-41b8-bca6-585cf6876525","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34766","PortSpecifier":{"PortValue":34766}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34766","PortSpecifier":{"PortValue":34766}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":768331845},"http":{"id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"60ceedad-edc6-4cf0-9f3f-54e70b95a1a0","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"60ceedad-edc6-4cf0-9f3f-54e70b95a1a0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff201bad-622c-4c6d-9cea-92dc774bfc21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"073fd559-6206-4583-81f6-6ee39e6cca47","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":777130944},"http":{"id":"073fd559-6206-4583-81f6-6ee39e6cca47","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"60ceedad-edc6-4cf0-9f3f-54e70b95a1a0","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"60ceedad-edc6-4cf0-9f3f-54e70b95a1a0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.56","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctMjJnNGcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.33~maas-default-gateway-openshift-default-56654dcf7-22g4g.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.56","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"073fd559-6206-4583-81f6-6ee39e6cca47"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"073fd559-6206-4583-81f6-6ee39e6cca47","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":777130944,"seconds":1783606524},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.56:34796","port":34796}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"60ceedad-edc6-4cf0-9f3f-54e70b95a1a0","keyName":"e2e-revoketest-a-1","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"073fd559-6206-4583-81f6-6ee39e6cca47","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34778","PortSpecifier":{"PortValue":34778}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34778","PortSpecifier":{"PortValue":34778}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":814839527},"http":{"id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02f632bd-ac84-49e9-aa4f-d42a7a1778ce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71d888ac-623a-42ce-adda-587af4709f5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"71d888ac-623a-42ce-adda-587af4709f5d","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71d888ac-623a-42ce-adda-587af4709f5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":822500756},"http":{"id":"71d888ac-623a-42ce-adda-587af4709f5d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"71d888ac-623a-42ce-adda-587af4709f5d","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.56","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctMjJnNGcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.33~maas-default-gateway-openshift-default-56654dcf7-22g4g.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.56","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"71d888ac-623a-42ce-adda-587af4709f5d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"71d888ac-623a-42ce-adda-587af4709f5d","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":822500756,"seconds":1783606524},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.56:34796","port":34796}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71d888ac-623a-42ce-adda-587af4709f5d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71d888ac-623a-42ce-adda-587af4709f5d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71d888ac-623a-42ce-adda-587af4709f5d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34780","PortSpecifier":{"PortValue":34780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"460f925a-8502-4e36-ad22-a0d504ff55e7","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34780","PortSpecifier":{"PortValue":34780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":854883350},"http":{"id":"460f925a-8502-4e36-ad22-a0d504ff55e7","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"460f925a-8502-4e36-ad22-a0d504ff55e7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02d32087-6202-4f33-b764-a0222e01104e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"02d32087-6202-4f33-b764-a0222e01104e","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02d32087-6202-4f33-b764-a0222e01104e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606524,"nanos":862773145},"http":{"id":"02d32087-6202-4f33-b764-a0222e01104e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"02d32087-6202-4f33-b764-a0222e01104e","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.56","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctMjJnNGcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.33~maas-default-gateway-openshift-default-56654dcf7-22g4g.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.56","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"02d32087-6202-4f33-b764-a0222e01104e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"02d32087-6202-4f33-b764-a0222e01104e","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":862773145,"seconds":1783606524},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.56:34796","port":34796}}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02d32087-6202-4f33-b764-a0222e01104e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02d32087-6202-4f33-b764-a0222e01104e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02d32087-6202-4f33-b764-a0222e01104e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eb16e69c9ad41d3c86fa93ba4e1f8932f77da044ceb7b2ace73444ea3b7676f8"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/801d2110c386f9c4a7b1c82ff910a3d30218c2465aea9b5a648a4abe11ddff12"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/634a9c6f775d51b513417adb66cad9313a9c2a9b364ed120f8d280f0e74f782c"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c502ea9e2761e2350ee4db9805e610502006f99bb023f5b1ac96048a37121106"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/731c2c146570c8fb65ebace9f4ba5a0bde51ab424649e34bf3b5d5188df506eb"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c2a729f1524e928759498e4ad7b4cfb57a9b2d8c1784034a363966331b2b4c5c"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2589109d6a360c29419cc13a11526a0b64fb15716f75bde517b9af9dbf458f2a"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/90582cd0526900518a2610697fe057d18ac7d235a0c32ce7e0482555b02b9acb"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f2de3dfbd5e2eeddfb0094bfec5ea5f38db5fa9e4199f154d9354e2605e11449"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7ff7aecf8933d5163a9eff4b2fca81c48baa25a968a40e8db1acfe2984da283c"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d906b0c5604ae59e836e13a387d78e805b52377390b629406d4e49d00bf419b9"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6d7b8a5995f42febce4eeb6941e95200f51472bf5b856d78e6681e3283ad94fb"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c789045b507f5179543308a943222e5ecdba0670a27f7493af92dadb5842f7b0"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/621ef7b30f984b974dbe50e07d75efdb412ae59c21feb0ed4728b5aba7371915"}
{"level":"info","ts":"2026-07-09T14:15:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e5cc4b85510223bd1d9e6a536ee252d0c5eb84bae16a85758bdfb0446a84823e"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34792","PortSpecifier":{"PortValue":34792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2306f406-60fa-4b30-b5fb-1e1017c09421","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34792","PortSpecifier":{"PortValue":34792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":134852060},"http":{"id":"2306f406-60fa-4b30-b5fb-1e1017c09421","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-66madwQIkqGTa5T7_L7EXgpKUrRwbK8KYzRixeZcAY431iCr4QaOcnbTyjl1\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2306f406-60fa-4b30-b5fb-1e1017c09421","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"x-ext-auth-reason":""},{"content-type":"application/json"}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":167717730},"http":{"id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-IGffQUGzzdsNYCJS_MgJRPv75laf8GOHEy0DjFIcI9EmfWmgrMrw7zhEecxg\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8758bf7d-677f-4a0b-8030-596c21f2ad4d","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"x-ext-auth-reason":""},{"content-type":"application/json"}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34810","PortSpecifier":{"PortValue":34810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aaa70851-75c4-441c-b106-fe3d367673ec","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34810","PortSpecifier":{"PortValue":34810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":198133621},"http":{"id":"aaa70851-75c4-441c-b106-fe3d367673ec","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aaa70851-75c4-441c-b106-fe3d367673ec","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":206044419},"http":{"id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-GYSHXpAFDuArp3uJ_D16hBMFx9TjgI9LUPK1QkoL0kjj7sOvs8Ii5VAHtSHz","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.56","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctMjJnNGcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.33~maas-default-gateway-openshift-default-56654dcf7-22g4g.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.56","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"40750dbc-1df6-44f1-a252-b0b58bed08cb"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":206044419,"seconds":1783606529},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.56:34796","port":34796}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"059c1248-c4c9-471a-94aa-bc4d69a1d867","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"40750dbc-1df6-44f1-a252-b0b58bed08cb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34814","PortSpecifier":{"PortValue":34814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34814","PortSpecifier":{"PortValue":34814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":239429945},"http":{"id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","method":"GET","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"997f2cd1-c7c8-4b34-be3a-4c7df4f857ad","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"024dd07e-8c11-49b5-8d02-f59972aeb599","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:34796","PortSpecifier":{"PortValue":34796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":247331009},"http":{"id":"024dd07e-8c11-49b5-8d02-f59972aeb599","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1admElHDq3ECzBZzj_k1vwvfppOoGOUbNG2Zp49y92Xgvs9A8Pq7OfAkam2Rz","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.56","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctMjJnNGcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.33~maas-default-gateway-openshift-default-56654dcf7-22g4g.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.56","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"024dd07e-8c11-49b5-8d02-f59972aeb599"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"024dd07e-8c11-49b5-8d02-f59972aeb599","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":247331009,"seconds":1783606529},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.56:34796","port":34796}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"024dd07e-8c11-49b5-8d02-f59972aeb599","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34830","PortSpecifier":{"PortValue":34830}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","method":"DELETE","path":"/maas-api/v1/api-keys/059c1248-c4c9-471a-94aa-bc4d69a1d867","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34830","PortSpecifier":{"PortValue":34830}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":282983700},"http":{"id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","method":"DELETE","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/059c1248-c4c9-471a-94aa-bc4d69a1d867",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/059c1248-c4c9-471a-94aa-bc4d69a1d867",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74c0b41c-a020-4dc3-b538-2a54b7064d62","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"691269ae-392d-458a-83d4-0996b8475693","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34836","PortSpecifier":{"PortValue":34836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"691269ae-392d-458a-83d4-0996b8475693","method":"DELETE","path":"/maas-api/v1/api-keys/c1941a0c-1c9d-4c52-bceb-a33f4a4c146c","host":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"691269ae-392d-458a-83d4-0996b8475693","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:34836","PortSpecifier":{"PortValue":34836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783606529,"nanos":317102667},"http":{"id":"691269ae-392d-458a-83d4-0996b8475693","method":"DELETE","headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c1941a0c-1c9d-4c52-bceb-a33f4a4c146c",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"691269ae-392d-458a-83d4-0996b8475693","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"]}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"691269ae-392d-458a-83d4-0996b8475693","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/1ab3421272c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1755978b-af2c-4b3a-a144-10d9c4038fd4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6e1511a-e3cc-4ab7-98f7-7e76c3e5f8c5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.c6fb7153-261a-49e8-82a1-1ab3421272c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c1941a0c-1c9d-4c52-bceb-a33f4a4c146c",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"691269ae-392d-458a-83d4-0996b8475693","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"691269ae-392d-458a-83d4-0996b8475693","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T14:15:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"691269ae-392d-458a-83d4-0996b8475693","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T14:16:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/df6c2afe796757307cf57fb75d5fad679cda1054b0af5ee751e05556af8a4e94"}
{"level":"info","ts":"2026-07-09T14:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7aea6a1af35daec3e92791f63c23a5b8c2f895eb3687dbb082c93a02e36c1e85"}
{"level":"info","ts":"2026-07-09T14:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2cd7e3267c7b838a385d0b37259816dd52e553089400f43cc3d55268523237bd"}
{"level":"info","ts":"2026-07-09T14:16:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/66b1278d1e679c74dad9556e40d2aca6ec87a32847ab2a385a8f514e07503fb7"}
{"level":"info","ts":"2026-07-09T14:16:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fb2d14f4491b5b1cb2989417ee626a37ea46b32e34d26c5648fc5d70881ba455"}
{"level":"info","ts":"2026-07-09T14:16:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/07a1e11b4ef2abd2ffc50b3d8717348f89037b41af6adee346a1153b7df423d7"}
{"level":"info","ts":"2026-07-09T14:16:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bc7c56c4bb300c7f2a3e2895be9715bf017a808ef10bb33850c32330dc57bd3b"}
{"level":"info","ts":"2026-07-09T14:16:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9b23587c2224252cbd8c736f73bd4283f22bc028611bd071c52566818f2a99a5"}