Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

authpolicy vip can not be used multiple times, authentication policy gets superseded #640

Open
progS1m opened this issue Mar 11, 2024 · 0 comments
Labels
enhancement New feature or request

Comments

@progS1m
Copy link

progS1m commented Mar 11, 2024

Describe the bug
In case you want to deploy an authpolicy using the same vip, the second deployment does super-seed the authentication policy instead of creating an atomar authentication policy. The Authentication Policy on Netscaler side has just the Expression "True".

To Reproduce
Steps:

  1. Download files: deployment-files.zip
  2. In the deployment files, replace the IP 1.2.3.4 with a valid public IP of your setup.
  3. Deploy my-content-a.yaml
  4. Check the config generated on the Netscaler, noticing the AAA created and it's authentication policy
  5. Deploy my-content-b.yaml
  6. Check the config generated on the Netscaler, noticing the AAA supersedes the config instead of creating an additional authentication policy.

Version of the Citrix Ingress Controller --> 1.24.4

Version of MPX/VPX/CPX --> VPX 13.1 51.15

Expected behavior

CIC should deploy an atomar authentication policy with an expression matching for the related host.

Logs
kubectl logs

--> Cannot share it here containing sensitive information, please drop a PM Google Chat.

Additional context

Workaround exists, by using an atomar public IP for each app. But this is a waste of public IPs and could not be a permanent workaround :-(

@subashd subashd added the enhancement New feature or request label Mar 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants