Support http_proxy env variable

[patlachance]

Authentication fails if the openshift cluster's public endpoint is reachable only through an http proxy.

Error message on my environment:

018/05/28 07:44:32 oauthproxy.go:582: error redeeming code (client:10.128.4.1:33746 ("10.0.1.152")): Post https://openshift_public_url/oauth/token: dial tcp xx.xx.xx.xx:443: getsockopt: connection timed out
2018/05/28 07:44:32 oauthproxy.go:399: ErrorPage 500 Internal Error Internal Error

I tried configuring uppercase and lowercase environment variables http_proxy & https_proxy but it doesn't work. I looked at the authproxy.go source code and proxy handling doesn't seem implemented.

This is a real show stopper for us because we would like to expose Prometheus dashboards to users coming from Internet and our openshift cluster can't be directly exposed on Internet.

[simo5]

I would expect you use -login-url and -redeem-url to override the oauh server endpoint values in this case. Oauth Proxy is supposed to be run within the cluster, going through another proxy sounds backwards.

[patlachance]

Oauth Proxy runs indeed within the cluster but it tries to reach the OpenShift Oauth Server using the {{openshift_master_cluster_public_hostname}} and not the {{openshift_master_cluster_hostname}}.

In my setup {{openshift_master_cluster_public_hostname}} resolves to a public Internet IP reachable only through a proxy. So Oauth Proxy can't reach the OpenShift Oauth server. And thus the OpenShift Enterprise ansible Prometheus recipe fails. A bug has been filed.

Setting -redeem-url to {{openshift_master_cluster_hostname}} would be an option but it seem more complicated to me to adapt ansible recipes so specific app configuration is applied than just pass http proxy env variable to execution environment.

[s-urbaniak]

@patlachance sorry for pinging back that late, I am looking now into this. In case you are still having this problem. Do you mind to give more details on how you configure the http(s) proxy settings?

[patlachance]

@s-urbaniak I still have the issue. Please find the oc -n openshift-metrics describe prometheus-0 output

[s-urbaniak]

@patlachance thank you for the configuration! Hm, I don't see anything wrong with that setup, HTTP_PROXY, HTTPS_PROXY, and NO_PROXY should be picked up as the http client executing the redemption of tokens uses the http.DefaultClient which in turn respects the above mentioned env vars.

From the Prometheus and Alertmanager side (of which this issue was reported initially) there is not much we can do except than passing through these env vars in the deployment.

I will leave this issue here for the maintainers of oauth-proxy to have a deeper look.

[patlachance]

I would expect you use -login-url and -redeem-url to override the oauh server endpoint values in this case. Oauth Proxy is supposed to be run within the cluster, going through another proxy sounds backwards.

@simo5 : I tried setting -redeem-url but get the following error

2018/11/10 07:56:05 oauthproxy.go:635: error redeeming code (client:10.128.4.1:33902 ("xx.xx.xx.xx")): got 403 from "https://internal-openshift-master.red.act.ed/auth/token" {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"forbidden: User \"system:anonymous\" cannot post path \"/auth/token\": no RBAC policy matched","reason":"Forbidden","details":{},"code":403}
2018/11/10 07:56:05 oauthproxy.go:434: ErrorPage 500 Internal Error Internal Error

I get similar error in the browser if I set -login-url.

@s-urbaniak : http proxy environment variables are not used, PR to follow

[akram]

@patlachance same issue here. redeem-url on a fresh 3.11 gives the same error.
Or public master URL cannot be reached from containers except by using http_proxy. Setting the redeem-url leads to no RBAC policy matched