Gatekeeper rejecting duplicate Ingress hosts after upgrade from 3.4.6 to 4.0.1

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

After upgrading IDSP from 3.4.6 to 4.0.1, Gatekeeper rejects the duplicate Ingress hosts.

Environment

Symantec Identity Security Platform 4.0.1

Resolution

The Gatekeeper policy unique-ingress-host rejects Ingress resources that share the same hostname. The SSP chart creates a companion -noaccess Ingress (to block sensitive paths) that shares the host with the main Ingress. This is by design and works fine with standard nginx ingress - eventhough the host is the same the paths are different. It seems that Gatekeeper's strict policy rejects any hostname duplication across Ingress objects regardless of the path.

The creation of the -noaccess Ingress resource is not a new behavior in version 4.0.1, as the 3.4.6 chart creates this exact same resource. The issue occurs now because the environment features a Gatekeeper policy that the system actively enforces during the upgrade process.