Configuring the Proxy for the connectware Helm Chart

Configure HTTP proxy settings for Connectware components that need outbound Internet access using the connectware Helm chart.

When Connectware runs behind a corporate proxy, the components that make outbound HTTP calls need a proxy address to reach the Internet. Configure these settings globally to apply the same proxy to every affected component, or per component when each one needs different settings. Per-component values take precedence over the matching global value.

Which Components Need Proxy Settings

Only auth-server (for SSO and OIDC calls) and system-control-server use proxy settings. Other components such as broker and NATS ignore them.

Configuration Values

The following values.yaml keys are available. Values set directly in values.yaml are plain strings. Values stored in a Kubernetes Secret (existingSecret) must be base64 encoded — kubectl create secret --from-literal handles this automatically.

Value	Type	Description
global.proxy.url	string	Address of the HTTP proxy server for auth-server and system-control-server.
global.proxy.exceptions	list of strings	Hosts for which the proxy is ignored, for auth-server and system-control-server.
global.proxy.existingSecret	string	Name of a Kubernetes Secret containing the proxy configuration for auth-server and system-control-server as the keys url and exceptions.
authServer.proxy.url	string	Address of the HTTP proxy server for auth-server. Takes precedence over global.proxy.url if set.
authServer.proxy.exceptions	list of strings	Hosts for which the proxy is ignored, for auth-server only. Takes precedence over global.proxy.exceptions if set.
authServer.proxy.existingSecret	string	Name of a Kubernetes Secret containing the proxy configuration for auth-server as the keys url and exceptions. Takes precedence over global.proxy.existingSecret if set.
systemControlServer.proxy.url	string	Address of the HTTP proxy server for system-control-server. Takes precedence over global.proxy.url if set.
systemControlServer.proxy.exceptions	list of strings	Hosts for which the proxy is ignored, for system-control-server only. Takes precedence over global.proxy.exceptions if set.
systemControlServer.proxy.existingSecret	string	Name of a Kubernetes Secret containing the proxy configuration for system-control-server as the keys url and exceptions. Takes precedence over global.proxy.existingSecret if set.

Configuring a Global Proxy

Set global.proxy to configure the same proxy for both auth-server and system-control-server in one place.

values.yaml

global:
  proxy:
    url: proxy.mycompany.tld
    exceptions:
      - my-server.mycompany.tld
      - my-internal-service.mycompany.tld

After editing your values.yaml, apply the changes by running the helm upgrade command. For details, see Applying Helm Configuration Changes.

Configuring Per-Component Proxies

Set authServer.proxy or systemControlServer.proxy to configure a proxy for one component only. Use this when the two components must reach different proxies, or when only one component needs proxy access.

values.yaml

authServer:
  proxy:
    url: proxy.mycompany.tld
    exceptions:
      - my-server.mycompany.tld
      - my-internal-service.mycompany.tld

systemControlServer:
  proxy:
    url: other-proxy.mycompany.tld

After editing your values.yaml, apply the changes by running the helm upgrade command. For details, see Applying Helm Configuration Changes.

Configuring an Authenticated Proxy

If your proxy requires authentication, embed the credentials directly in the url value. This applies whether you are setting the URL inline in values.yaml or storing it in a Kubernetes Secret.

http://${USERNAME}:${PASSWORD}@proxy.mycompany.tld

• Replace ${USERNAME} with the proxy account username.

• Replace ${PASSWORD} with the proxy account password.

After editing your values.yaml, apply the changes by running the helm upgrade command. For details, see Applying Helm Configuration Changes.

Using an Existing Kubernetes Secret

Use the existingSecret field to reference a Kubernetes Secret instead of setting url and exceptions inline. The secret must contain a url key and optionally an exceptions key, both base64 encoded. When existingSecret is set, it takes priority over any inline url or exceptions value.

kubectl create secret --from-literal base64-encodes the values automatically. If you create the secret from a YAML manifest, you must base64-encode the values yourself.

Create the secret:

kubectl create secret generic ${SECRET_NAME} \
  --from-literal=url='proxy.mycompany.tld' \
  --from-literal=exceptions='my-server.mycompany.tld,my-internal-service.mycompany.tld' \
  --namespace ${NAMESPACE}

• Replace ${SECRET_NAME} with the name you want to give the Kubernetes Secret.

• Replace ${NAMESPACE} with the namespace of your Connectware installation.

• The exceptions value must be a comma-separated string.

• For an authenticated proxy, use http://${USERNAME}:${PASSWORD}@proxy.mycompany.tld as the url value.

Reference the secret in your values.yaml file. The existingSecret field works at both the global and per-component level:

values.yaml

# Applies to both auth-server and system-control-server
global:
  proxy:
    existingSecret: '${SECRET_NAME}'

# Overrides global for auth-server only
authServer:
  proxy:
    existingSecret: '${AUTH_SERVER_SECRET_NAME}'

After editing your values.yaml, apply the changes by running the helm upgrade command. For details, see Applying Helm Configuration Changes.