Red Hat OpenShift Container Platform

Configuring a proxy after installation

Configuring a proxy after installation using OpenShift Cluster Manager

You can use Red Hat OpenShift Cluster Manager to add a cluster-wide proxy configuration to an existing Red Hat OpenShift Container Platform cluster in a Virtual Private Cloud (VPC).

You can also use OpenShift Cluster Manager to update an existing cluster-wide proxy configuration. For example, you might need to update the network address for the proxy or replace the additional trust bundle if any of the certificate authorities for the proxy expire.

The cluster applies the proxy configuration to the control plane and compute nodes. While applying the configuration, each cluster node is temporarily placed in an unschedulable state and drained of its workloads. The process restarts each node.

Prerequisites

You have an Red Hat OpenShift Container Platform cluster.
You deploy your cluster in a VPC.

Procedure

Navigate to OpenShift Cluster Manager and select your cluster.
Under the Virtual Private Cloud (VPC) section on the Networking page, click Edit cluster-wide proxy.
On the Edit cluster-wide proxy page, give your proxy configuration details:
1. Enter a value in at least one of the following fields:
  - Specify a valid HTTP proxy URL.
  - Specify a valid HTTPS proxy URL.
  - In the Additional trust bundle field, give a Privacy Enhanced Mail (PEM) encoded X.509 certificate bundle.
    
    If you are replacing an existing trust bundle file, select Replace file to view the field. The system adds the bundle to the trusted certificate store for the cluster nodes. You must use an additional trust bundle file if you use a TLS-inspecting proxy unless an authority from the Red Hat Enterprise Linux CoreOS (RHCOS) trust bundle signs the identity certificate for the proxy. This requirement applies regardless of whether the proxy is transparent or requires explicit configuration by using the http-proxy and https-proxy arguments.
2. Click Confirm.

Verification

Under the Virtual Private Cloud (VPC) section on the Networking page, verify that the proxy configuration for your cluster is as expected.

Configuring a proxy after installation using the CLI

You can use the ROSA CLI (rosa) to add a cluster-wide proxy configuration to an existing ROSA cluster in a Virtual Private Cloud (VPC).

You can also use rosa to update an existing cluster-wide proxy configuration. For example, you might need to update the network address for the proxy or replace the additional trust bundle if any of the certificate authorities for the proxy expire.

Prerequisites

You have installed and configured the latest ROSA (rosa) and OpenShift (oc) command-line interfaces (CLIs) on your installation host.
You have deployed your Red Hat OpenShift Container Platform cluster in a VPC.

Procedure

Edit the cluster configuration to add or update the cluster-wide proxy details:

$ rosa edit cluster \
 --cluster $CLUSTER_NAME \
 --additional-trust-bundle-file <path_to_ca_bundle_file> \
 --http-proxy http://<username>:<password>@<ip>:<port> \
 --https-proxy https://<username>:<password>@<ip>:<port> \
  --no-proxy example.com

where:

The additional-trust-bundle-file, http-proxy, and https-proxy arguments are all optional.

The additional-trust-bundle-file argument is a file path pointing to a bundle of PEM-encoded X.509 certificates, which are all concatenated together. The additional-trust-bundle-file argument is required for users who use a TLS-inspecting proxy unless the identity certificate for the proxy is signed by an authority from the Red Hat Enterprise Linux CoreOS (RHCOS) trust bundle. This applies regardless of whether the proxy is transparent or requires explicit configuration using the http-proxy and https-proxy arguments.

Do not attempt to change the proxy or additional trust bundle configuration on the cluster directly. Any changes must be applied by using the ROSA CLI (rosa) or Red Hat OpenShift Cluster Manager. Any changes made directly to managed resources on the cluster are reverted automatically.

The http-proxy and https-proxy arguments must point to a valid URL.
A comma-separated list of destination domain names, IP addresses, or network CIDRs to exclude proxying.
Preface a domain with . to match subdomains only. For example, .y.com matches x.y.com, but not y.com. Use * to bypass proxy for all destinations.
If you scale up workers that are not included in the network defined by the networking.machineNetwork[].cidr field from the installation configuration, you must add them to this list to prevent connection issues.
This field is ignored if neither the httpProxy nor httpsProxy fields are set.

Verification

Display the proxy configuration for your cluster and verify that the details are as expected:

$ oc get proxy cluster -o yaml

Example output

apiVersion: config.openshift.io/v1
kind: Proxy
spec:
  httpProxy: http://proxy.host.domain:<port>
  httpsProxy: https://proxy.host.domain:<port>
  <...more...>
status:
  httpProxy: http://proxy.host.domain:<port>
  httpsProxy: https://proxy.host.domain:<port>
  <...more...>

Removing a cluster-wide proxy

You can remove your cluster-wide proxy by using the ROSA CLI. After removing the proxy, you should also remove any trust bundles that you added to the cluster.

Removing the cluster-wide proxy using CLI

You must use the ROSA CLI, rosa, to remove the proxy’s address from your cluster.

Prerequisites

You must have cluster administrator privileges.
You have installed the ROSA CLI (rosa).

Procedure

Use the rosa edit command to change the proxy. You must pass empty strings to the --http-proxy and --https-proxy arguments to clear the proxy from the cluster:

$ rosa edit cluster -c <cluster_name> --http-proxy "" --https-proxy ""

While your proxy might only use one of the proxy arguments, the system ignores the empty fields, so passing empty strings to both the --http-proxy and --https-proxy arguments does not cause any issues.

Example output

I: Updated cluster <cluster_name>

Verification

You can verify that you removed the proxy from the cluster by using the rosa describe command:

$ rosa describe cluster -c <cluster_name>

Before removal, the proxy IP displays in a proxy section:

Name:                       <cluster_name>
ID:                         <cluster_internal_id>
External ID:                <cluster_external_id>
OpenShift Version:          {product-version}.0
Channel Group:              stable
DNS:                        <dns>
AWS Account:                <aws_account_id>
API URL:                    <api_url>
Console URL:                <console_url>
Region:                     us-east-1
Multi-AZ:                   false
Nodes:
 - Control plane:           3
 - Infra:                   2
 - Compute:                 2
Network:
 - Type:                    OVNKubernetes
 - Service CIDR:            <service_cidr>
 - Machine CIDR:            <machine_cidr>
 - Pod CIDR:                <pod_cidr>
 - Host Prefix:             <host_prefix>
Proxy:
 - HTTPProxy:               <proxy_url>
Additional trust bundle:    REDACTED

After removing the proxy, the proxy section is removed:

Name:                       <cluster_name>
ID:                         <cluster_internal_id>
External ID:                <cluster_external_id>
OpenShift Version:          {product-version}.0
Channel Group:              stable
DNS:                        <dns>
AWS Account:                <aws_account_id>
API URL:                    <api_url>
Console URL:                <console_url>
Region:                     us-east-1
Multi-AZ:                   false
Nodes:
 - Control plane:           3
 - Infra:                   2
 - Compute:                 2
Network:
 - Type:                    OVNKubernetes
 - Service CIDR:            <service_cidr>
 - Machine CIDR:            <machine_cidr>
 - Pod CIDR:                <pod_cidr>
 - Host Prefix:             <host_prefix>
Additional trust bundle:    REDACTED

Removing certificate authorities on a Red Hat OpenShift Container Platform cluster

You can remove certificate authorities (CA) from your cluster with the ROSA CLI, rosa.

Prerequisites

You must have cluster administrator privileges.
You have installed the ROSA CLI (rosa).
Your cluster has certificate authorities added.

Procedure

Use the rosa edit command to change the CA trust bundle. You must pass empty strings to the --additional-trust-bundle-file argument to clear the trust bundle from the cluster:
```
$ rosa edit cluster -c <cluster_name> --additional-trust-bundle-file ""
```
Example output
```
I: Updated cluster <cluster_name>
```

Verification

To verify that you removed the trust bundle from the cluster, use the rosa describe command:

$ rosa describe cluster -c <cluster_name>

Before removal, the Additional trust bundle section is displayed, redacting its value for security purposes:

Name:                       <cluster_name>
ID:                         <cluster_internal_id>
External ID:                <cluster_external_id>
OpenShift Version:          {product-version}.0
Channel Group:              stable
DNS:                        <dns>
AWS Account:                <aws_account_id>
API URL:                    <api_url>
Console URL:                <console_url>
Region:                     us-east-1
Multi-AZ:                   false
Nodes:
 - Control plane:           3
 - Infra:                   2
 - Compute:                 2
Network:
 - Type:                    OVNKubernetes
 - Service CIDR:            <service_cidr>
 - Machine CIDR:            <machine_cidr>
 - Pod CIDR:                <pod_cidr>
 - Host Prefix:             <host_prefix>
Proxy:
 - HTTPProxy:               <proxy_url>
Additional trust bundle:    REDACTED

After you remove the proxy, the Additional trust bundle section no longer displays:

Name:                       <cluster_name>
ID:                         <cluster_internal_id>
External ID:                <cluster_external_id>
OpenShift Version:          {product-version}.0
Channel Group:              stable
DNS:                        <dns>
AWS Account:                <aws_account_id>
API URL:                    <api_url>
Console URL:                <console_url>
Region:                     us-east-1
Multi-AZ:                   false
Nodes:
 - Control plane:           3
 - Infra:                   2
 - Compute:                 2
Network:
 - Type:                    OVNKubernetes
 - Service CIDR:            <service_cidr>
 - Machine CIDR:            <machine_cidr>
 - Pod CIDR:                <pod_cidr>
 - Host Prefix:             <host_prefix>
Proxy:
 - HTTPProxy:               <proxy_url>