Red Hat OpenShift Container Platform

Configuring a proxy during installation

Configuring a proxy during installation using OpenShift Cluster Manager

If you are installing cluster into an existing Virtual Private Cloud (VPC), you can use Red Hat OpenShift Cluster Manager to enable a cluster-wide HTTP or HTTPS proxy during installation.

Before the installation, you must verify that the proxy is accessible from the VPC that you install the cluster into. The proxy must also be accessible from the private subnets of the VPC.

Configuring a proxy during installation using the CLI

If you are installing a Red Hat OpenShift Container Platform cluster into an existing Virtual Private Cloud (VPC), you can use the ROSA CLI (rosa) to enable a cluster-wide HTTP or HTTPS proxy during installation.

The following procedure provides details about the ROSA CLI (rosa) arguments that you use to configure a cluster-wide proxy during installation.

Prerequisites

You have verified that the proxy is accessible from the VPC that you install the cluster into. The proxy must also be accessible from the private subnets of the VPC.

Procedure

Specify a proxy configuration when you create your cluster:
```
$ rosa create cluster \
 <other_arguments_here> \
 --additional-trust-bundle-file <path_to_ca_bundle_file> \
 --http-proxy http://<username>:<password>@<ip>:<port> \
 --https-proxy https://<username>:<password>@<ip>:<port> \
 --no-proxy example.com
```
where:
- The additional-trust-bundle-file, http-proxy, and https-proxy arguments are all optional.
- The additional-trust-bundle-file argument is a file path pointing to a bundle of PEM-encoded X.509 certificates, which are all concatenated together. The additional-trust-bundle-file argument is required for users who use a TLS-inspecting proxy unless the identity certificate for the proxy is signed by an authority from the Red Hat Enterprise Linux CoreOS (RHCOS) trust bundle. This applies regardless of whether the proxy is transparent or requires explicit configuration using the http-proxy and https-proxy arguments.
- The http-proxy and https-proxy arguments must point to a valid URL.
- A comma-separated list of destination domain names, IP addresses, or network CIDRs to exclude proxying.
- Preface a domain with . to match subdomains only. For example, .y.com matches x.y.com, but not y.com. Use * to bypass proxy for all destinations.
- If you scale up workers that are not included in the network defined by the networking.machineNetwork[].cidr field from the installation configuration, you must add them to this list to prevent connection issues.
- This field is ignored if neither the httpProxy nor httpsProxy fields are set.