> For the complete documentation index, see [llms.txt](https://docs.cybus.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybus.io/2-4-1/cybus-helm-charts/connectware-helm-chart/proxy-configuration.md). # Configuring the Proxy for the connectware Helm Chart When Connectware runs behind a corporate proxy, the components that make outbound HTTP calls need a proxy address to reach the Internet. Configure these settings globally to apply the same proxy to every affected component, or per component when each one needs different settings. Per-component values take precedence over the matching global value. ## Which Components Need Proxy Settings Only **auth-server** (for SSO and OIDC calls) and **system-control-server** use proxy settings. Other components such as **broker** and **NATS** ignore them. ## Configuration Values The following `values.yaml` keys are available. Values set directly in `values.yaml` are plain strings. Values stored in a Kubernetes Secret (`existingSecret`) must be base64 encoded — `kubectl create secret --from-literal` handles this automatically. | Value | Type | Description | | ------------------------------------------ | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `global.proxy.url` | string | Address of the HTTP proxy server for auth-server and system-control-server. | | `global.proxy.exceptions` | list of strings | Hosts for which the proxy is ignored, for auth-server and system-control-server. | | `global.proxy.existingSecret` | string | Name of a Kubernetes Secret containing the proxy configuration for auth-server and system-control-server as the keys `url` and `exceptions`. | | `authServer.proxy.url` | string | Address of the HTTP proxy server for auth-server. Takes precedence over `global.proxy.url` if set. | | `authServer.proxy.exceptions` | list of strings | Hosts for which the proxy is ignored, for auth-server only. Takes precedence over `global.proxy.exceptions` if set. | | `authServer.proxy.existingSecret` | string | Name of a Kubernetes Secret containing the proxy configuration for auth-server as the keys `url` and `exceptions`. Takes precedence over `global.proxy.existingSecret` if set. | | `systemControlServer.proxy.url` | string | Address of the HTTP proxy server for system-control-server. Takes precedence over `global.proxy.url` if set. | | `systemControlServer.proxy.exceptions` | list of strings | Hosts for which the proxy is ignored, for system-control-server only. Takes precedence over `global.proxy.exceptions` if set. | | `systemControlServer.proxy.existingSecret` | string | Name of a Kubernetes Secret containing the proxy configuration for system-control-server as the keys `url` and `exceptions`. Takes precedence over `global.proxy.existingSecret` if set. | ## Configuring a Global Proxy Set `global.proxy` to configure the same proxy for both auth-server and system-control-server in one place. {% code title="values.yaml" lineNumbers="true" %} ```yaml global: proxy: url: proxy.mycompany.tld exceptions: - my-server.mycompany.tld - my-internal-service.mycompany.tld ``` {% endcode %} After editing your `values.yaml`, apply the changes by running the `helm upgrade` command. For details, see [Applying Helm Configuration Changes](/2-4-1/cybus-helm-charts/working-with-cybus-helm-charts.md#applying-helm-configuration-changes). ## Configuring Per-Component Proxies Set `authServer.proxy` or `systemControlServer.proxy` to configure a proxy for one component only. Use this when the two components must reach different proxies, or when only one component needs proxy access. {% code title="values.yaml" lineNumbers="true" %} ```yaml authServer: proxy: url: proxy.mycompany.tld exceptions: - my-server.mycompany.tld - my-internal-service.mycompany.tld systemControlServer: proxy: url: other-proxy.mycompany.tld ``` {% endcode %} After editing your `values.yaml`, apply the changes by running the `helm upgrade` command. For details, see [Applying Helm Configuration Changes](/2-4-1/cybus-helm-charts/working-with-cybus-helm-charts.md#applying-helm-configuration-changes). ## Configuring an Authenticated Proxy If your proxy requires authentication, embed the credentials directly in the `url` value. This applies whether you are setting the URL inline in `values.yaml` or storing it in a Kubernetes Secret. ``` http://${USERNAME}:${PASSWORD}@proxy.mycompany.tld ``` * Replace `${USERNAME}` with the proxy account username. * Replace `${PASSWORD}` with the proxy account password. After editing your `values.yaml`, apply the changes by running the `helm upgrade` command. For details, see [Applying Helm Configuration Changes](/2-4-1/cybus-helm-charts/working-with-cybus-helm-charts.md#applying-helm-configuration-changes). ## Using an Existing Kubernetes Secret Use the `existingSecret` field to reference a Kubernetes Secret instead of setting `url` and `exceptions` inline. The secret must contain a `url` key and optionally an `exceptions` key, both base64 encoded. When `existingSecret` is set, it takes priority over any inline `url` or `exceptions` value. `kubectl create secret --from-literal` base64-encodes the values automatically. If you create the secret from a YAML manifest, you must base64-encode the values yourself. **Create the secret:** {% code lineNumbers="true" %} ```bash kubectl create secret generic ${SECRET_NAME} \ --from-literal=url='proxy.mycompany.tld' \ --from-literal=exceptions='my-server.mycompany.tld,my-internal-service.mycompany.tld' \ --namespace ${NAMESPACE} ``` {% endcode %} * Replace `${SECRET_NAME}` with the name you want to give the Kubernetes Secret. * Replace `${NAMESPACE}` with the namespace of your Connectware installation. * The `exceptions` value must be a comma-separated string. * For an authenticated proxy, use `http://${USERNAME}:${PASSWORD}@proxy.mycompany.tld` as the `url` value. **Reference the secret in your `values.yaml` file.** The `existingSecret` field works at both the global and per-component level: {% code title="values.yaml" lineNumbers="true" %} ```yaml # Applies to both auth-server and system-control-server global: proxy: existingSecret: '${SECRET_NAME}' # Overrides global for auth-server only authServer: proxy: existingSecret: '${AUTH_SERVER_SECRET_NAME}' ``` {% endcode %} After editing your `values.yaml`, apply the changes by running the `helm upgrade` command. For details, see [Applying Helm Configuration Changes](/2-4-1/cybus-helm-charts/working-with-cybus-helm-charts.md#applying-helm-configuration-changes). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.cybus.io/2-4-1/cybus-helm-charts/connectware-helm-chart/proxy-configuration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.