RequestAuthentication is Created Only for the Last Mentioned Service in APIRule

[abhinavvsinghh]

Description

When defining multiple services under a single APIRule (v2alpha1) in Kyma, only the last mentioned service has a RequestAuthentication resource created. Other services listed earlier in the APIRule do not get their corresponding RequestAuthentication resources, leading to authentication failures when trying to access their endpoints.

Expected result

Each service defined in the APIRule should have its own corresponding RequestAuthentication resource, ensuring all services are properly

Actual result

Only the last service listed in the APIRule has a RequestAuthentication resource created. The other services do not have their authentication configurations applied, making their endpoints inaccessible due to missing authentication.

Steps to reproduce

1. Define an APIRule with multiple services (under same host with JWT auth).

apiVersion: gateway.kyma-project.io/v2alpha1
kind: APIRule
metadata:
  name: {APIRULE_NAME}
  namespace: {APIRULE_NAMESPACE}
spec:
  hosts:
    - {SUBDOMAIN}.{DOMAIN_NAME}
  gateway: {GATEWAY_NAMESPACE}/{GATEWAY_NAME}
  rules:
  - path: /api/service1/create
    methods: ["POST"]
    jwtAuth:
      authentications:
        - issuer: {JWT_ISSUER}
          jwksUri: {JWKS_URI}
    service:
      name: {FIRST_SERVICE_NAME}
      port: {FIRST_SERVICE_PORT}
  - path: /api/service2/create
    methods: ["POST"]
    jwtAuth:
      authentications:
        - issuer: {JWT_ISSUER}
          jwksUri: {JWKS_URI}
    service:
      name: {SECOND_SERVICE_NAME}
      port: {SECOND_SERVICE_PORT}

2. Apply the APIRule to the Kyma cluster.
3. Check the created RequestAuthentication resources.
4. Observe that only the last mentioned service in the APIRule has a corresponding RequestAuthentication resource.
5. Attempt to access an endpoint of an earlier-listed service, and notice authentication failures.

Troubleshooting

Manually creating a RequestAuthentication resource for the missing services resolves the issue, and authentication works as expected.

[barchw]

Hello @abhinavvsinghh I couldn't reproduce your issue unfortunately, as for the following APIRule:

apiVersion: gateway.kyma-project.io/v2alpha1
kind: APIRule
metadata:
  name: aaa
  namespace: sidecar-enabled
spec:
  gateway: kyma-system/kyma-gateway
  hosts:
  - aaaa
  rules:
  - jwt:
      authentications:
      - issuer: https://example.com
        jwksUri: https://example.com/headers
    methods:
    - POST
    path: /api/service1/create
    service:
      name: httpbin4
      port: 8000
  - jwt:
      authentications:
      - issuer: https://example.com
        jwksUri: https://example.com/headers
    methods:
    - POST
    path: /api/service2/create
    service:
      name: httpbin3
      port: 8000

I get two RequestAuthentication resources. If you would like us to investigate further, please provide your exact case.
By the way, it seems you are using jwtAuth instead of jwt.