From 7a1e8a71891fd7a98a6aa683ef0fbf0818b54ea3 Mon Sep 17 00:00:00 2001 From: "Christian M. Adams" Date: Tue, 21 Jul 2026 21:51:05 -0400 Subject: [PATCH 1/2] fix: augment NO_PROXY with required internal exclusions in proxy-env ConfigMap When a cluster-wide egress proxy is configured on OCP, NO_PROXY is propagated verbatim from the operator pod environment. OCP's default NO_PROXY uses .svc/.svc.cluster.local suffix patterns that do not match the bare short service names used for internal communication, causing internal traffic to route through the corporate proxy. Augment NO_PROXY before writing it to the ConfigMap: preserve customer entries first, then append required exclusions (loopbacks, .svc suffixes, CR short name, namespaced CR name). Use unique filter for determinism across reconciliation loops. Emit NO_PROXY whenever any proxy var is set. Related: AAP-83822 Signed-off-by: Christian M. Adams --- roles/eda/templates/eda-proxy-env.configmap.yaml.j2 | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/roles/eda/templates/eda-proxy-env.configmap.yaml.j2 b/roles/eda/templates/eda-proxy-env.configmap.yaml.j2 index 7d2a0045..7e4a8030 100644 --- a/roles/eda/templates/eda-proxy-env.configmap.yaml.j2 +++ b/roles/eda/templates/eda-proxy-env.configmap.yaml.j2 @@ -13,7 +13,10 @@ data: HTTPS_PROXY: '{{ https_proxy }}' https_proxy: '{{ https_proxy }}' {% endif %} -{% if no_proxy %} - NO_PROXY: '{{ no_proxy }}' - no_proxy: '{{ no_proxy }}' +{% if http_proxy or https_proxy or no_proxy %} +{% set _no_proxy_list = (no_proxy | default('')).split(',') | map('trim') | select | list %} +{% set _required = ['localhost', '127.0.0.1', '::1', '[::1]', '.svc', '.svc.cluster.local', ansible_operator_meta.name, ansible_operator_meta.name + '.' + ansible_operator_meta.namespace, ansible_operator_meta.name + '-api', ansible_operator_meta.name + '-api.' + ansible_operator_meta.namespace, ansible_operator_meta.name + '-daphne', ansible_operator_meta.name + '-daphne.' + ansible_operator_meta.namespace] %} +{% set _augmented = (_no_proxy_list + _required) | unique | join(',') %} + NO_PROXY: {{ _augmented | to_yaml }} + no_proxy: {{ _augmented | to_yaml }} {% endif %} From 4abc64c52d965acaed3874ebd091129a53314575 Mon Sep 17 00:00:00 2001 From: "Christian M. Adams" Date: Wed, 22 Jul 2026 10:46:43 -0400 Subject: [PATCH 2/2] fix: add automation_server_url hostname to NO_PROXY exclusions EDA (via ansible-rulebook) contacts the gateway when launching Job Templates using EDA_CONTROLLER_URL, which resolves to automation_server_url in the EDA CR spec. If this URL's hostname is not in NO_PROXY, those calls are routed through the corporate proxy instead of staying in-cluster. Since automation_server_url is user-provided and may differ from the EDA CR name, the hostname cannot be statically inferred. Extract it from the configured URL at template render time and append it to the required exclusion list. Signed-off-by: Christian M. Adams --- roles/eda/tasks/deploy_eda.yml | 8 ++++++++ roles/eda/templates/eda-proxy-env.configmap.yaml.j2 | 10 ++++++++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/roles/eda/tasks/deploy_eda.yml b/roles/eda/tasks/deploy_eda.yml index 144899de..eef89c73 100644 --- a/roles/eda/tasks/deploy_eda.yml +++ b/roles/eda/tasks/deploy_eda.yml @@ -25,6 +25,14 @@ definition: "{{ lookup('template', 'eda.configmap.yaml.j2') }}" wait: yes +- name: Set gateway and controller hostnames for NO_PROXY exclusion + ansible.builtin.set_fact: + _gateway_hostname: >- + {{ extra_settings | default([]) | selectattr('setting', 'equalto', 'EDA_ANSIBLE_BASE_JWT_KEY') + | map(attribute='value') | select | list | first | default('') + | urlsplit('hostname') }} + _controller_hostname: "{{ automation_server_url | default('') | urlsplit('hostname') }}" + - name: Apply proxy environment ConfigMap k8s: apply: yes diff --git a/roles/eda/templates/eda-proxy-env.configmap.yaml.j2 b/roles/eda/templates/eda-proxy-env.configmap.yaml.j2 index 7e4a8030..74c50320 100644 --- a/roles/eda/templates/eda-proxy-env.configmap.yaml.j2 +++ b/roles/eda/templates/eda-proxy-env.configmap.yaml.j2 @@ -16,7 +16,13 @@ data: {% if http_proxy or https_proxy or no_proxy %} {% set _no_proxy_list = (no_proxy | default('')).split(',') | map('trim') | select | list %} {% set _required = ['localhost', '127.0.0.1', '::1', '[::1]', '.svc', '.svc.cluster.local', ansible_operator_meta.name, ansible_operator_meta.name + '.' + ansible_operator_meta.namespace, ansible_operator_meta.name + '-api', ansible_operator_meta.name + '-api.' + ansible_operator_meta.namespace, ansible_operator_meta.name + '-daphne', ansible_operator_meta.name + '-daphne.' + ansible_operator_meta.namespace] %} +{% if _gateway_hostname | default('') %} +{% set _required = (_required + [_gateway_hostname, _gateway_hostname + '.' + ansible_operator_meta.namespace]) | unique %} +{% endif %} +{% if _controller_hostname | default('') %} +{% set _required = (_required + [_controller_hostname, _controller_hostname + '.' + ansible_operator_meta.namespace]) | unique %} +{% endif %} {% set _augmented = (_no_proxy_list + _required) | unique | join(',') %} - NO_PROXY: {{ _augmented | to_yaml }} - no_proxy: {{ _augmented | to_yaml }} + NO_PROXY: '{{ _augmented }}' + no_proxy: '{{ _augmented }}' {% endif %}