Skip to content

authpolicy vip can not be used multiple times, authentication policy gets superseded #640

Open
@progS1m

Description

@progS1m

Describe the bug
In case you want to deploy an authpolicy using the same vip, the second deployment does super-seed the authentication policy instead of creating an atomar authentication policy. The Authentication Policy on Netscaler side has just the Expression "True".

To Reproduce
Steps:

  1. Download files: deployment-files.zip
  2. In the deployment files, replace the IP 1.2.3.4 with a valid public IP of your setup.
  3. Deploy my-content-a.yaml
  4. Check the config generated on the Netscaler, noticing the AAA created and it's authentication policy
  5. Deploy my-content-b.yaml
  6. Check the config generated on the Netscaler, noticing the AAA supersedes the config instead of creating an additional authentication policy.

Version of the Citrix Ingress Controller --> 1.24.4

Version of MPX/VPX/CPX --> VPX 13.1 51.15

Expected behavior

CIC should deploy an atomar authentication policy with an expression matching for the related host.

Logs
kubectl logs

--> Cannot share it here containing sensitive information, please drop a PM Google Chat.

Additional context

Workaround exists, by using an atomar public IP for each app. But this is a waste of public IPs and could not be a permanent workaround :-(

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions