Using cert-manager addon behin a proxy

General Discussions microk8s
1

Hi,

I would like to use the cert-manager add behind a http proxy. So far I did not find any obvious way to configure the proxy values. Is there any recommended way to do this?

Greetings Peter

2

Proxy configuration is often handled at the MicroK8s or container runtime level rather than inside the cert-manager addon itself. The exact setting can depend on whether the addon invokes a controller image pull or an ACME request, so separating those two paths should help narrow it down.

3

The thread describes the cert-manager addon behind an HTTP proxy but no obvious proxy setting. A safe first check is whether the cert-manager controller pod actually has HTTP_PROXY, HTTPS_PROXY, and a suitable NO_PROXY value in its environment; if those are absent, the addon deployment—not the certificate resources—is the likely configuration point.

4

Thanks for the reponses @Blake.Rivera20 as well for the information what could be the reason! :blush: The container seems to be “distroless” (if this the correct term) so I’ve got no chance to jump into the container.

I’ve tried a microk8s kubectl describe pod cert-manager-5fcb9844ff-gx75j -n cert-manager but did just get one env var in the output: POD_NAMESPACE.

The only thing I found so far is a git pull request for setting a configuration option for the deployment via helm - Helm: add http_proxy, https_proxy, and no_proxy by maelvls · Pull Request #409 · cert-manager/approver-policy · GitHub

Am I missing something or is my use case (internal use of ACME) just a niche use case?

5

Because the ACME request originates from the controller, the deployment template is the useful place to inspect; image pulls follow the container runtime’s proxy settings separately.

6

Adding the environment variables for HTTP_PROXY, … to the cert-manager controller deployment worked. :slight_smile:

[...]
      containers:
        - name: cert-manager-controller
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: HTTPS_PROXY
              value: http://myproxy.org:8080
            - name: HTTP_PROXY
              value: http://myproxy.org:8080
            - name: NO_PROXY
              value: localhost,127.0.0.1,::1,10.1.0.0/16,10.152.0.0/16,192.168.0.0/16
[...]

@Blake.Rivera20: Thanks again for your help. :blush: