OAUTH2_PROXY_UPSTREAMS is not working

[mehdi-benhajabbes]

I'm using oauth2-proxy :7.3.0 through Kubernetes. I'm setting all my config as environment variables:

1. I'm setting my environment variables as data in a configMap
2. I'm injecting that data in oauth2-proxy container using envFrom and referencing my configMap

Expected Behavior

OAUTH2_PROXY_UPSTREAMS should work but it is not and the upstream is apparently set to the default 0.0.0.0:8080 causing a 502 Bad Gateway

In the configMap I'm setting
OAUTH2_PROXY_UPSTREAMS: "http://127.0.0.1:80"

When I remove OAUTH2_PROXY_UPSTREAMS from the config map and set the --upstream through command line using

args:
  - --upstream=http://127.0.0.1:80 #it's the same value I'm using for OAUTH2_PROXY_UPSTREAMS

It works as charm.

Context

I prefer setting everything as environment variables

• Version used: 7.3.0

[JoelSpeed]

As upstream is a command line that can be provided multiple times, perhaps when you provide it as a env var you need to set it as a slice, eg, ["value"], did you try this at all?

Note, in the future we are likely to be removing a lot of the environment variable configuration as we move towards structured config, as you're using Kubernetes already this should be a simple change to load the configmap into the pod rather than into env vars

[merlyel]

I faced the same issue (not on Kubernetes though, but on IBM Cloud Code Engine)
There's one interesting thing here: as long as pod does not have custom arguments specified, OAUTH2_PROXY_UPSTREAMS variable does not work. But as soon as I add any argument (I added --cookie-secure=true) OAUTH2_PROXY_UPSTREAMS starts working.
As for format - it worked without a problem in the format of OAUTH2_PROXY_UPSTREAMS=http://redir1:8080/
So the issue is not array formatting

[JoelSpeed]

That is bizarre and nothing springs to mind about why that might be, unfortunately the configuration is all loaded via viper so I'm wondering if this is a viper issue? Has anyone checked viper for a similar issue?

[skratzmeier]

Hey,
Setting an upstream Url OAUTH2_PROXY_UPSTREAMS works fine for me on the official docker image.
For example: OAUTH2_PROXY_UPSTREAMS: "http://traefik:80/"

However, setting OAUTH2_PROXY_UPSTREAMS will not work on oauth2-proxy images packaged by bitnami - as they have a --upstream argument hardcoded in their Dockerfile:
https://github.com/bitnami/containers/blob/main/bitnami/oauth2-proxy/7/debian-11/Dockerfile

[benni336]

I do not want to comment how unnecessary that hard coding (and moving away from official docs) is.
There is some very ugly smiley for it but. I will keep my fingers calm and my keyboard silent.

May I ask, what is meant by "official docker image"? "Building from source"?

[skratzmeier]

I do not want to comment how unnecessary that hard coding (and moving away from official docs) is. There is some very ugly smiley for it but. I will keep my fingers calm and my keyboard silent.

May I ask, what is meant by "official docker image"? "Building from source"?

Was referring to https://quay.io/repository/oauth2-proxy/oauth2-proxy

[github-actions]

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

[RobbieMcKinstry]

Great sleuthing! This issue was really helpful to me. I would have spent forever trying to figure out what was wrong.

[x45dev]

Hey, Setting an upstream Url OAUTH2_PROXY_UPSTREAMS works fine for me on the official docker image. For example: OAUTH2_PROXY_UPSTREAMS: "http://traefik:80/"

However, setting OAUTH2_PROXY_UPSTREAMS will not work on oauth2-proxy images packaged by bitnami - as they have a --upstream argument hardcoded in their Dockerfile: https://github.com/bitnami/containers/blob/main/bitnami/oauth2-proxy/7/debian-11/Dockerfile

Thank you!