fix(proxy): NO_PROXY covers the cloud metadata IP (chart + both installers)#337
Open
LukasWodka wants to merge 1 commit into
Open
fix(proxy): NO_PROXY covers the cloud metadata IP (chart + both installers)#337LukasWodka wants to merge 1 commit into
LukasWodka wants to merge 1 commit into
Conversation
The auto-augmented NO_PROXY lists (chart tracebloc.proxyEnv helper, bash _augment_no_proxy defaults, Windows Get-EffectiveNoProxy defaults) omitted 169.254.169.254 — behind a corporate proxy, cloud metadata lookups would be routed through the external proxy (broken IMDS access and an unnecessary place for instance credentials to transit). Add the IP to all three lists in lockstep, pin it in the bats + Pester + helm-unittest expectations, regenerate manifest.sha256 for the two touched installer scripts, bump chart 1.9.3 -> 1.9.4. Ref tracebloc/backend#803 (item J), tracebloc/client-runtime#120 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The auto-augmented
NO_PROXYlists omitted the cloud metadata IP169.254.169.254, so on proxy tenants metadata traffic would be sent to the corporate proxy (broken IMDS access; instance credentials transiting a middlebox for no reason). Adds the IP to the chart helper (tracebloc.proxyEnv), the bash installer defaults (_augment_no_proxy), and the Windows defaults (Get-EffectiveNoProxy) — the three lists stay in lockstep — and regeneratesmanifest.sha256for the two touched scripts. Chart bumped 1.9.3 → 1.9.4.This is the chart/installer half of backend#803 item J; the runtime half (jobs-manager/ingestor NO_PROXY strings) ships separately in client-runtime alongside the #120 fix.
Related
Ref tracebloc/backend#803 (item J). Ref tracebloc/client-runtime#120.
Type of change
Test plan
helm unittest client: 25 suites / 267 tests pass, including the three updated exact-valueNO_PROXYassertions inclient/tests/proxy_env_test.yamlbats scripts/tests/cluster.bats: 27 tests pass, including a new169.254.169.254assertion on_augment_no_proxyGet-EffectiveNoProxy(runs in CI's Windows job)scripts/gen-manifest.shregenerated — exactly thecluster.sh+install-k8s.ps1digests changed; CI--checkgate stays greenhelm lint clientfails on develop already (schema requires non-emptyclientId/clientPassword) — pre-existing, unrelatedChecklist
🤖 Generated with Claude Code
Note
Low Risk
Narrow proxy-bypass list change with installer/chart parity and test coverage; no auth or data-model changes.
Overview
Adds
169.254.169.254(link-local cloud metadata) to the auto-augmentedNO_PROXYlists so corporate-proxy tenants do not send IMDS traffic through the HTTP proxy.The same default is applied in
tracebloc.proxyEnv(Helm),TB_NO_PROXY_DEFAULTS/_augment_no_proxy(bash installer), andGet-EffectiveNoProxy(Windows installer), with helm unittest, bats, and Pester expectations updated. Chart version is bumped 1.9.3 → 1.9.4, andscripts/manifest.sha256is refreshed for the touched installer scripts.Reviewed by Cursor Bugbot for commit 60a1dd3. Bugbot is set up for automated code reviews on this repo. Configure here.