-
Notifications
You must be signed in to change notification settings - Fork 71
WIP 🐛 OCPBUGS-61082: Add HTTP proxy support for operator deployments #2501
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
tmshort
wants to merge
1
commit into
operator-framework:main
Choose a base branch
from
tmshort:fix-OCPBUGS-61082
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+1,217
−18
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,126 @@ | ||
| // Package proxy defines HTTP proxy configuration types used across applier implementations. | ||
| package proxy | ||
|
|
||
| import ( | ||
| "crypto/sha256" | ||
| "encoding/json" | ||
| "fmt" | ||
| "net/url" | ||
| "os" | ||
| "strings" | ||
| ) | ||
|
|
||
| const ( | ||
| // ConfigHashKey is the annotation key used to record the proxy configuration hash. | ||
| // This annotation is set on both ClusterExtensions and ClusterExtensionRevisions. | ||
| // When the hash changes on a ClusterExtension, it triggers reconciliation. | ||
| // Comparing hashes between ClusterExtension and its current revision determines | ||
| // if a new revision is needed due to proxy configuration changes. | ||
| ConfigHashKey = "olm.operatorframework.io/proxy-config-hash" | ||
| ) | ||
|
|
||
| // Proxy holds HTTP proxy configuration values that are applied to rendered resources. | ||
| // These values are typically set as environment variables on generated Pods to enable | ||
| // operators to function correctly in environments that require HTTP proxies for outbound | ||
| // connections. | ||
| type Proxy struct { | ||
| // HTTPProxy is the HTTP proxy URL (e.g., "http://proxy.example.com:8080"). | ||
| // An empty value means no HTTP proxy is configured. | ||
| HTTPProxy string | ||
| // HTTPSProxy is the HTTPS proxy URL (e.g., "https://proxy.example.com:8443"). | ||
| // An empty value means no HTTPS proxy is configured. | ||
| HTTPSProxy string | ||
| // NoProxy is a comma-separated list of hosts, domains, or CIDR ranges that should | ||
| // bypass the proxy (e.g., "localhost,127.0.0.1,.cluster.local"). | ||
| // An empty value means all traffic will use the proxy (if configured). | ||
| NoProxy string | ||
| // fingerprint is a cached hash of the proxy configuration, calculated once during construction. | ||
| // This is used to detect when proxy settings change and a new revision is needed. | ||
| fingerprint string | ||
| } | ||
|
|
||
| // NewFromEnv creates a new Proxy from environment variables. | ||
| // Returns nil if no proxy environment variables are set. | ||
| // The fingerprint is calculated once during construction and cached. | ||
| func NewFromEnv() *Proxy { | ||
| httpProxy := os.Getenv("HTTP_PROXY") | ||
| httpsProxy := os.Getenv("HTTPS_PROXY") | ||
| noProxy := os.Getenv("NO_PROXY") | ||
|
|
||
| // If no proxy variables are set, return nil | ||
| if httpProxy == "" && httpsProxy == "" && noProxy == "" { | ||
| return nil | ||
| } | ||
|
|
||
| p := &Proxy{ | ||
| HTTPProxy: httpProxy, | ||
| HTTPSProxy: httpsProxy, | ||
| NoProxy: noProxy, | ||
| } | ||
|
|
||
| // Calculate and cache the fingerprint | ||
| p.fingerprint = calculateFingerprint(p) | ||
|
|
||
| return p | ||
| } | ||
|
|
||
| // calculateFingerprint computes a stable hash of the proxy configuration. | ||
| func calculateFingerprint(p *Proxy) string { | ||
| if p == nil { | ||
| return "" | ||
| } | ||
| data, err := json.Marshal(p) | ||
| if err != nil { | ||
| // This should never happen for a simple struct with string fields, | ||
| // but return empty string if it does | ||
| return "" | ||
| } | ||
| hash := sha256.Sum256(data) | ||
| return fmt.Sprintf("%x", hash[:8]) | ||
| } | ||
|
|
||
| // Fingerprint returns the cached hash of the proxy configuration. | ||
| // This is used to detect when proxy settings change and a new revision is needed. | ||
| // Returns an empty string if the proxy is nil. | ||
| func (p *Proxy) Fingerprint() string { | ||
| if p == nil { | ||
| return "" | ||
| } | ||
| return p.fingerprint | ||
| } | ||
|
|
||
| // SanitizeURL removes credentials from a proxy URL for safe logging. | ||
| // Returns the original string if it's not a valid URL or doesn't contain credentials. | ||
| // If the string contains @ but credentials can't be parsed out, returns a redacted version. | ||
| func SanitizeURL(proxyURL string) string { | ||
| if proxyURL == "" { | ||
| return "" | ||
| } | ||
|
|
||
| u, err := url.Parse(proxyURL) | ||
| if err != nil { | ||
| // If we can't parse it, check if it might contain credentials (user:pass@host pattern) | ||
| // If so, redact it to avoid leaking credentials in logs | ||
| if strings.Contains(proxyURL, "@") { | ||
| return "<redacted>" | ||
| } | ||
| // Otherwise return as-is (might be a hostname or other format without credentials) | ||
| return proxyURL | ||
| } | ||
tmshort marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| // If there's user info, remove it and return sanitized URL | ||
| if u.User != nil { | ||
| u.User = nil | ||
| return u.String() | ||
| } | ||
|
|
||
| // If no user info was parsed but the string contains @, it might be a schemelessly-formatted | ||
| // URL like "user:pass@host:port" which url.Parse doesn't recognize as having credentials. | ||
| // Redact it to be safe. | ||
| if strings.Contains(proxyURL, "@") { | ||
| return "<redacted>" | ||
| } | ||
|
|
||
| // No credentials detected, return as-is | ||
| return proxyURL | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.