Chapter 19. Working with HTTP Proxies
Production environments can deny direct access to the Internet and instead have an HTTP or HTTPS proxy available. Configuring OpenShift Enterprise to use these proxies can be as simple as setting standard environment variables in configuration or JSON files. This can be done during an advanced installation or configured after installation.
The proxy configuration must be the same on each host in the cluster. Therefore, when setting up the proxy or modifying it, you must update the files on each OpenShift Enterprise host to the same values. Then, you must restart OpenShift Enterprise services on each host in the cluster.
HTTPS_PROXY environment variables are found in each host’s /etc/sysconfig/atomic-openshift-master file (for single master configuration), /etc/sysconfig/atomic-openshift-master-api, or /etc/sysconfig/atomic-openshift-master-controllers files (for multi-master configuration) and /etc/sysconfig/atomic-openshift-node.
19.2. Configuring NO_PROXY
NO_PROXY environment variable lists all of the OpenShift Enterprise components and all IP addresses that are managed by OpenShift Enterprise.
NO_PROXY accepts a comma-separated list of hosts, IP addresses, or IP ranges in CIDR format:
- For master hosts
- Node host name
- Master IP or host name
- For node hosts
- Master IP or host name
- For the Docker service
- Registry service IP and host name
NO_PROXY also includes the SDN network and service IP addresses as found in the master-config.yaml file.
networkConfig: clusterNetworkCIDR: 10.1.0.0/16 serviceNetworkCIDR: 172.30.0.0/16
OpenShift Enterprise does not accept
* as a wildcard attached to a domain suffix. For example, this works:
However, this does not:
The only wildcard
NO_PROXY accepts is a single
* character, which matches all hosts, and effectively disables the proxy.
Each name in this list is matched as either a domain which contains the host name as a suffix, or the host name itself.
For instance, example.com would match example.com, example.com:80, and www.example.com.
19.3. Configuring Hosts for Proxies
Edit the proxy environment variables in the OpenShift Enterprise control files. Ensure all of the files in the cluster are correct.
HTTP_PROXY=http://USERNAME:PASSWORD@10.0.1.1:8080/ HTTPS_PROXY=https://USERNAME:PASSWORD@10.0.0.1:8080/ NO_PROXY=master.hostname.example.com,10.1.0.0/16,172.30.0.0/16 1
- Supports host names and CIDRs. Must include the SDN network and service IP ranges
Restart the master or node host as appropriate:
# systemctl restart atomic-openshift-master # systemctl restart atomic-openshift-node
For multi-master installations:
# systemctl restart atomic-openshift-master-controllers # systemctl restart atomic-openshift-master-api
19.4. Configuring Hosts for Proxies Using Ansible
During advanced installations, the
HTTPS_PROXY environment variables can be configured using the
openshift_https_proxy parameters, which are configurable in the inventory file.
Example 19.1. Example Proxy Configuration with Ansible
# Global Proxy Configuration # These options configure HTTP_PROXY, HTTPS_PROXY, and NOPROXY environment # variables for docker and master services. openshift_http_proxy=http://USER:PASSWORD@IPADDR:PORT openshift_https_proxy=https://USER:PASSWORD@IPADDR:PORT openshift_no_proxy='.hosts.example.com,some-host.com' # # Most environments do not require a proxy between OpenShift masters, nodes, and # etcd hosts. So automatically add those host names to the openshift_no_proxy list. # If all of your hosts share a common domain you may wish to disable this and # specify that domain above. # openshift_generate_no_proxy_hosts=True
openshift_builddefaults_git_https_proxy parameters allow you to use a proxy for Git cloning
19.5. Proxying Docker Pull
OpenShift Enterprise node hosts need to perform push and pull operations to Docker registries. If you have a registry that does not need a proxy for nodes to access, include the
NO_PROXY parameter with the registry’s host name, the registry service’s IP address, and service name. This blacklists that registry, leaving the external HTTP proxy as the only option.
Edit the /etc/sysconfig/docker file and add the variables in shell format:
HTTP_PROXY=http://USERNAME:PASSWORD@10.0.1.1:8080/ HTTPS_PROXY=https://USERNAME:PASSWORD@10.0.0.1:8080/ NO_PROXY=master.hostname.example.com,172.30.123.45,docker-registry.default.svc.cluster.local
Restart the Docker service:
# systemctl restart docker
19.6. Configuring S2I Builds for Proxies
S2I builds fetch dependencies from various locations. You can use a .s2i/environment file to specify simple shell variables and OpenShift Enterprise will react accordingly when seeing build images.
The following are the supported proxy environment variables with example values:
HTTP_PROXY=http://USERNAME:PASSWORD@10.0.1.1:8080/ HTTPS_PROXY=https://USERNAME:PASSWORD@10.0.0.1:8080/ NO_PROXY=master.hostname.example.com
19.7. Configuring Default Templates for Proxies
The example templates available in OpenShift Enterprise by default do not include settings for HTTP proxies. For existing applications based on these templates, modify the
source section of the application’s build configuration and add proxy settings:
... source: type: Git git: uri: https://github.com/openshift/ruby-hello-world httpProxy: http://proxy.example.com httpsProxy: https://proxy.example.com ...
This is similar to the process for using proxies for Git cloning.
19.8. Setting Proxy Environment Variables in Pods
You can set the
HTTPS_PROXY environment variables in the
templates.spec.containers stanza in a deployment configuration to pass proxy connection information. The same can be done for configuring a Pod’s proxy at runtime:
... containers: - env: - name: "HTTP_PROXY" value: "http://USER:PASSWORD@IPADDR:PORT" ...
You can also use the
oc set env command to update an existing deployment configuration with a new environment variable:
$ oc set env dc/frontend HTTP_PROXY=http://USER:PASSWORD@IPADDR:PORT
If you have a ConfigChange trigger set up in your OpenShift Enterprise instance, the changes happen automatically. Otherwise, manually redeploy your application for the changes to take effect.
19.9. Git Repository Access
If your Git repository can only be accessed using a proxy, you can define the proxy to use in the
source section of the
BuildConfig. You can configure both a HTTP and HTTPS proxy to use. Both fields are optional.
Your source URI must use the HTTP or HTTPS protocol for this to work.
source: type: Git git: uri: "https://github.com/openshift/ruby-hello-world" httpProxy: http://proxy.example.com httpsProxy: https://proxy.example.com
Cluster administrators can also configure a global proxy for Git cloning using Ansible.