API Validation for EgressProxySpec #3077
Comments
Automatic merge from submit-queue Add support for cluster using http forward proxy #2481 Adds support for running a cluster where access to external resources must be done through an http forward proxy. This adds a new element to the ClusterSpec, `EgressProxy`, and then sets up environment variables where appropriate. Access to API servers is additionally assumed to be done through the proxy, in particular this is necessary for AWS VPCs with private topology and egress by proxy (no NAT), at least until Amazon implements VPC Endpoints for the APIs. Additionally, see my notes in #2481 TODOs - [x] Consider editing files from nodeup rather than cloudup - [x] Add support for RHEL - [x] Validate on RHEL - [x] ~Add support for CoreOS~ See #3032 - [x] ~Add support for vSphere~ See #3071 - [x] Minimize services effected - [x] ~Support seperate https_proxy configuration~ See #3069 - [x] ~Remove unvalidated proxy auth support (save for future PR)~ See #3070 - [x] Add Documentation - [x] Fill in some sensible default exclusions for the user, allow the user to extend this list - [x] Address PR review comments - [x] Either require port or handle nil - [x] ~Do API validation (or file an issue for validation)~ See #3077 - [x] Add uppercase versions of proxy env vars to cover our bases - [x] ~File an issue for unit tests~ 😬 See #3072 - [x] Validate cluster upgrades and updates - [x] Remove ftp_proxy (nothing uses)
|
Issues go stale after 90d of inactivity. Prevent issues from auto-closing with an If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or |
k8s-ci-robot
added
the
lifecycle/stale
|
Stale issues rot after 30d of inactivity. If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
k8s-ci-robot
added
lifecycle/rotten
|
Rotten issues close after 30d of inactivity. Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
We are adding support for clusters behind http forward proxies to the ClusterSpec, called EgressProxySpec. Validation should be added for this.
I would suggest also requiring an explicit Port for HTTPProxy rather than allowing the user to omit it at this stage, as in practice, using the transport default ports 80 and 443 for proxy servers is not the typical case, and I think it might prevent users some pain to just make them state what it is explicitly.
The text was updated successfully, but these errors were encountered: