Description
Describe the bug
In case you want to deploy an authpolicy using the same vip, the second deployment does super-seed the authentication policy instead of creating an atomar authentication policy. The Authentication Policy on Netscaler side has just the Expression "True".
To Reproduce
Steps:
- Download files: deployment-files.zip
- In the deployment files, replace the IP 1.2.3.4 with a valid public IP of your setup.
- Deploy my-content-a.yaml
- Check the config generated on the Netscaler, noticing the AAA created and it's authentication policy
- Deploy my-content-b.yaml
- Check the config generated on the Netscaler, noticing the AAA supersedes the config instead of creating an additional authentication policy.
Version of the Citrix Ingress Controller --> 1.24.4
Version of MPX/VPX/CPX --> VPX 13.1 51.15
Expected behavior
CIC should deploy an atomar authentication policy with an expression matching for the related host.
Logs
kubectl logs
--> Cannot share it here containing sensitive information, please drop a PM Google Chat.
Additional context
Workaround exists, by using an atomar public IP for each app. But this is a waste of public IPs and could not be a permanent workaround :-(