RequestAuthentication is Created Only for the Last Mentioned Service in APIRule

[abhinavvsinghh]

Description

When defining multiple services under a single APIRule (v2alpha1) in Kyma, only the last mentioned service has a RequestAuthentication resource created. Other services listed earlier in the APIRule do not get their corresponding RequestAuthentication resources, leading to authentication failures when trying to access their endpoints.

Expected result

Each service defined in the APIRule should have its own corresponding RequestAuthentication resource, ensuring all services are properly

Actual result

Only the last service listed in the APIRule has a RequestAuthentication resource created. The other services do not have their authentication configurations applied, making their endpoints inaccessible due to missing authentication.

Steps to reproduce

1. Define an APIRule with multiple services (under same host with JWT auth).

apiVersion: gateway.kyma-project.io/v2alpha1
kind: APIRule
metadata:
  name: {APIRULE_NAME}
  namespace: {APIRULE_NAMESPACE}
spec:
  hosts:
    - {SUBDOMAIN}.{DOMAIN_NAME}
  gateway: {GATEWAY_NAMESPACE}/{GATEWAY_NAME}
  rules:
  - path: /api/service1/create
    methods: ["POST"]
    jwtAuth:
      authentications:
        - issuer: {JWT_ISSUER}
          jwksUri: {JWKS_URI}
    service:
      name: {FIRST_SERVICE_NAME}
      port: {FIRST_SERVICE_PORT}
  - path: /api/service2/create
    methods: ["POST"]
    jwtAuth:
      authentications:
        - issuer: {JWT_ISSUER}
          jwksUri: {JWKS_URI}
    service:
      name: {SECOND_SERVICE_NAME}
      port: {SECOND_SERVICE_PORT}

2. Apply the APIRule to the Kyma cluster.
3. Check the created RequestAuthentication resources.
4. Observe that only the last mentioned service in the APIRule has a corresponding RequestAuthentication resource.
5. Attempt to access an endpoint of an earlier-listed service, and notice authentication failures.

Troubleshooting

Manually creating a RequestAuthentication resource for the missing services resolves the issue, and authentication works as expected.