Chapter 9. Configuring a proxy for external network access

Procedure

1. Save the existing secret as a YAML file:

   $ oc -n stackrox get secret proxy-config \
     -o go-template='{{index .data "config.yaml" | \
     base64decode}}{{"\n"}}' > /tmp/proxy-config.yaml

2. Edit the fields you want to modify in the YAML configuration file, as specified in the Configure proxy during installation section.

3. After you save the changes, run the following command to replace the secret:

   $ oc -n stackrox create secret generic proxy-config \
     --from-file=config.yaml=/tmp/proxy-config.yaml -o yaml --dry-run | \
     oc label -f - --local -o yaml app.kubernetes.io/name=stackrox | \
     oc apply -f -

   Important
   • You must wait for at least 1 minute, until OpenShift Container Platform propagates your changes to Central and Scanner.
   • If you see any issues with outgoing connections after changing the proxy configuration, you must restart your Central and Scanner pods.

Procedure

1. Open the configuration file central/proxy-config-secret.yaml from your deployment bundle directory.

   Note

   If you are using Helm the configuration file is at central/templates/proxy-config-secret.yaml.

2. Edit the fields you want to modify in the configuration file:

   apiVersion: v1
   kind: Secret
   metadata:
     namespace: stackrox
     name: proxy-config
   type: Opaque
   stringData:
     config.yaml: |- 1
       # # NOTE: Both central and scanner should be restarted if this secret is changed.
       # # While it is possible that some components will pick up the new proxy configuration
       # # without a restart, it cannot be guaranteed that this will apply to every possible
       # # integration etc.
       # url: http://proxy.name:port 2
       # username: username 3
       # password: password 4
       # # If the following value is set to true, the proxy wil NOT be excluded for the default hosts:
       # # - *.stackrox, *.stackrox.svc
       # # - localhost, localhost.localdomain, 127.0.0.0/8, ::1
       # # - *.local
       # omitDefaultExcludes: false
       # excludes:  # hostnames (may include * components) for which you do not 5
       # # want to use a proxy, like in-cluster repositories.
       # - some.domain
       # # The following configuration sections allow specifying a different proxy to be used for HTTP(S) connections.
       # # If they are omitted, the above configuration is used for HTTP(S) connections as well as TCP connections.
       # # If only the `http` section is given, it will be used for HTTPS connections as well.
       # # Note: in most cases, a single, global proxy configuration is sufficient.
       # http:
       #   url: http://http-proxy.name:port 6
       #   username: username 7
       #   password: password 8
       # https:
       #   url: http://https-proxy.name:port 9
       #   username: username 10
       #   password: password 11

   3 4 7 8 10 11

   Adding a username and a password is optional, both at the beginning and in the http and https sections.

   2 6 9

   The url option supports the following URL schemes:

   • http:// for an HTTP proxy.
   • https:// for a TLS-enabled HTTP proxy.
   • socks5:// for a SOCKS5 proxy.

   5

   The excludes list can contain DNS names (with or without * wildcards), IP addresses, or IP blocks in CIDR notation (for example, 10.0.0.0/8). The values in this list are applied to all outgoing connections, regardless of protocol.

   1

   The |- line in the stringData section indicates the start of the configuration data.

   Note

   • When you first open the file, all values are commented out (by using the # sign at the beginning of the line). Lines starting with double hash signs # # contain explanation of the configuration keys.
   • Make sure that when you edit the fields, you maintain an indentation level of two spaces relative to the config.yaml: |- line.

3. After editing the configuration file, you can proceed with your usual installation. The updated configuration instructs Red Hat Advanced Cluster Security for Kubernetes to use the proxy running on the provided address and the port number.