Configuring the cluster-wide proxy | Networking | OpenShift Container Platform 4.2

Enabling the cluster-wide proxy
Removing the cluster-wide proxy

Production environments can deny direct access to the Internet and instead have an HTTP or HTTPS proxy available. You can configure OpenShift Container Platform to use a proxy by modifying the Proxy object for existing clusters or by configuring the proxy settings in the install-config.yaml file for new clusters.

The cluster-wide proxy is only supported if you used a user-provisioned infrastructure installation for a supported provider.

Prerequisites

Review the sites that your cluster requires access to and determine whether any of them must bypass the proxy. By default, all cluster egress traffic is proxied, including calls to the cloud provider API for the cloud that hosts your cluster. Add sites to the Proxy object’s spec.noProxy field to bypass the proxy if necessary.

The Proxy object’s status.noProxy field is populated by default with the instance metadata endpoint (169.254.169.254) and with the values of the networking.machineCIDR, networking.clusterNetwork.cidr, and networking.serviceNetwork fields from your installation configuration.

Enabling the cluster-wide proxy

The Proxy object is used to manage the cluster-wide egress proxy. When a cluster is installed or upgraded without the proxy configured, a Proxy object is still generated but it will have a nil spec. For example:

apiVersion: config.openshift.io/v1
kind: Proxy
metadata:
  name: cluster
spec:
  trustedCA:
    name: ""
status:

A cluster administrator can configure the proxy for OpenShift Container Platform by modifying this cluster Proxy object.

Only the Proxy object named cluster is supported, and no additional proxies can be created.

Prerequisites

Cluster administrator permissions
OpenShift Container Platform oc CLI tool installed

Procedure

Create a configmap that contains any additional CA certificates required for proxying HTTPS connections.

You can skip this step if the proxy’s identity certificate is signed by an authority from the RHCOS trust bundle.

Create a file called user-ca-bundle.yaml with the following contents, and provide the values of your PEM-encoded certificates:

apiVersion: v1
data:
  ca-bundle.crt: | (1)
    <MY_PEM_ENCODED_CERTS> (2)
kind: configmap
metadata:
  name: user-ca-bundle (3)
  namespace: openshift-config (4)

1	This data key must be named `ca-bundle.crt`.
2	One or more PEM-encoded X.509 certificates used to sign the proxy’s identity certificate.
3	The configmap name that will be referenced from the Proxy object.
4	The configmap must be in the `openshift-config` namespace.

Create the configmap from this file:
```
$ oc create -f user-ca-bundle.yaml
```

Use the oc edit command to modify the Proxy object:
```
$ oc edit proxy/cluster
```

Configure the necessary fields for the proxy:

apiVersion: config.openshift.io/v1
kind: Proxy
metadata:
  name: cluster
spec:
  httpProxy: http://<username>:<pswd>@<ip>:<port> (1)
  httpsProxy: http://<username>:<pswd>@<ip>:<port> (2)
  noProxy: example.com (3)
  readinessEndpoints:
  - http://www.google.com (4)
  - https://www.google.com
  trustedCA:
    name: user-ca-bundle (5)

1	A proxy URL to use for creating HTTP connections outside the cluster. The URL scheme must be `http`.
2	A proxy URL to use for creating HTTPS connections outside the cluster. If this is not specified, then `httpProxy` is used for both HTTP and HTTPS connections. The URL scheme must be `http`; `https` is currently not supported.
3	A comma-separated list of destination domain names, domains, IP addresses or other network CIDRs to exclude proxying. Preface a domain with `.` to include all subdomains of that domain. Use `*` to bypass proxy for all destinations. Note that if you scale up workers not included in `networking.machineCIDR` from the installation configuration, you must add them to this list to prevent connection issues.
4	One or more URLs external to the cluster to use to perform a readiness check before writing the `httpProxy` and `httpsProxy` values to status.
5	A reference to the configmap in the `openshift-config` namespace that contains additional CA certificates required for proxying HTTPS connections. Note that the configmap must already exist before referencing it here. This field is required unless the proxy’s identity certificate is signed by an authority from the RHCOS trust bundle.

Save the file to apply the changes.

Removing the cluster-wide proxy

The cluster Proxy object cannot be deleted. To remove the proxy from a cluster, remove all spec fields from the Proxy object.

Prerequisites

Cluster administrator permissions
OpenShift Container Platform oc CLI tool installed

Procedure

Use the oc edit command to modify the proxy:
```
$ oc edit proxy/cluster
```

Remove all spec fields from the Proxy object. For example:

apiVersion: config.openshift.io/v1
kind: Proxy
metadata:
  name: cluster
spec: {}
status: {}

Save the file to apply the changes.