fix: use scoped squid proxy for staging Developer Portal downloads#87
Merged
Conversation
Configure a custom HTTP transport proxy in Download() that routes only Red Hat staging domains (*.qa.redhat.com, *.stage.redhat.com, etc.) through squid.corp.redhat.com:3128. All other traffic goes direct. This is needed because the staging portal redirects to access.cdn.stage.redhat.com for file downloads, which also requires proxy access. Follows the Red Hat proxy auto-configuration rules from hdn.corp.redhat.com/proxy.pac without requiring global HTTPS_PROXY env vars in CI pipelines. Implements SECURESIGN-2158 Signed-off-by: Sachin Sampras M <sampras343@gmail.com>
osmman
approved these changes
Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
support.Download()that routes only Red Hat staging domains (*.qa.redhat.com,*.stage.redhat.com,*.dev.redhat.com,*.preprod.redhat.com) throughsquid.corp.redhat.com:3128HTTPS_PROXYneededdevelopers.qa.redhat.com→access.cdn.stage.redhat.comContext
The operator's ConsoleCLIDownload manifests point to production
developers.redhat.com. During pre-release testing, the openshift strategy falls back to staging (developers.qa.redhat.com), which is behind a preprod lockdown requiring the corporate squid proxy. This change embeds the proxy routing in the download function following the Red Hat PAC file rules (hdn.corp.redhat.com/proxy.pac).Verified locally
Implements SECURESIGN-2158