cic not export routes to Netscaler (rbacRole True)

[ofaruk89]

Version 1.43.7

When we set rbacRole to true, CIC does not export routes to netscaler. When we set rbacRole to false, it sends routes to netscaler, but since it discovers all namespaces, it puts a lot of pressure on the cluster API and causes the system to crash. How can we solve the route problem when rbacRole is in true mode?

[sivakumarpcitrix]

"routes to netscaler.", does it mean node related ip addresses added as routes in NetScaler?
If so, under RBAC role: CIC can't listen to cluster level resource related events. So, node level information will not be served.

May I know more details on "lot of pressure on the cluster API"?
if you are looking at number of api call's made to Kubernetes-API, you may un-install unwanted CRD's (like fetch CRD's with citrix.com and un-install/delete them), it should reduce the number of API-calls.

May I know customer/company details...

[subashd]

hi @ofaruk89
Please provide the logs for troubleshooting and also could you please fill the questionaires?

Regards,
Subash Dangol

[ofaruk89]

CIC is navigating to discover all namespaces. However, we set a namespace filter (namespaceLabels: kubernetes.io/metadata.name=istio-ingress). Last year, due to this issue, the cluster API became inaccessible and the cluster crashed.

CIC is currently not ready and constantly restarts.

Platform: OpenShift 4.16.36
CIC version: Citrix-k8s-ingress-controller: 1.23.10
Netscaler version: NS13.1 59.19.nc

logs attached

testboxgateway-cic-citrix-ingress-controller-7d6d4d8d85-hncm9-cic (1).log

[subashd]

hi @ofaruk89
We have introduced argument rbacRole to provide NSIC access to the namespace where it is deployed.
Please set the same while deploying .
https://github.com/netscaler/netscaler-helm-charts/releases/tag/cicv1.28.2

[ofaruk89]

Sorry I wrote the cic version wrong. Our cic version 1.43.7

we are using this configuration

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/instance: testboxgateway-cic
  name: testboxgateway-cic-citrix-ingress-controller
  namespace: istio-ingress
spec:
  replicas: 1
  selector:
    matchLabels:
      router: testboxgateway-cic-citrix-ingress-controller
  template:
    metadata:
      annotations: null
      labels:
        router: testboxgateway-cic-citrix-ingress-controller
      name: cic
    spec:
      containers:
        - args:
            - '--configmap istio-ingress/testboxgateway-cic-cic-configmap'
            - '--ingress-classes citrix'
            - '--service-classes citrix'
            - '--feature-node-watch true'
            - '--enable-cnc-pbr false'
            - '--update-ingress-status yes'
          env:
            - name: NS_IP
              value: 10.119.0.177
            - name: NS_VIP
              value: 10.113.254.22
            - name: NS_NITRO_READ_TIMEOUT
              value: '60'
            - name: LIVENESS_FILE_PATH
              value: /tmp/liveness_path.log
            - name: NS_USER
              valueFrom:
                secretKeyRef:
                  key: username
                  name: nslogin
            - name: NS_PASSWORD
              valueFrom:
                secretKeyRef:
                  key: password
                  name: nslogin
            - name: EULA
              value: 'true'
            - name: NAMESPACE_LABELS
              value: kubernetes.io/metadata.name=istio-ingress
            - name: NS_APPS_NAME_PREFIX
              value: cic
            - name: DISABLE_OPENSHIFT_ROUTES
              value: 'true'
            - name: BGP_ADVERTISEMENT
              value: 'false'
          image: >-
            harbor.ourlocalarea.net/migration/citrix/citrix-k8s-ingress-controller:1.43.7
          imagePullPolicy: IfNotPresent
          livenessProbe:
            exec:
              command:
                - /bin/sh
                - '-c'
                - >
                  FILE_PATH="$LIVENESS_FILE_PATH"

                  [ -f "$FILE_PATH" ] && [ $(( $(date +%s) - $(stat -c %Y
                  "$FILE_PATH") )) -lt 60 ] && exit 0 || exit 1
            initialDelaySeconds: 30
            periodSeconds: 60
          name: cic
          readinessProbe:
            exec:
              command:
                - cat
                - /tmp/readiness
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 60
            successThreshold: 1
          resources:
            limits: {}
            requests:
              cpu: 32m
              memory: 128Mi
      serviceAccountName: testboxgateway-cic-citrix-ingress-controller

[subashd]

hi @ofaruk89
Could you please send the RBAC (Cluster Role, ClusterRole Binding and service Account) along with deployment and configmap of NSIC to the following email address?
subash.dangol@cloud.com, sivakumar.perumalla@cloud.com