Configure proxy authentication

You can configure the Kubernetes k3s environment, Edge Gateway instance and apps to use a proxy server when required to reach external sites, such as quay.io. You need to know your proxy server settings, such as DNS name, IP address and account name if authentication is required.

Configuring a connection to a proxy server for one component does not configure it for any other component. When configuring proxy settings, you need to configure the following components separately:

Kubernetes k3s environment.
Each instance of Edge Gateway.
Each app that requires a connection to a proxy server.

At the system hosting the Edge Gateway, edit the file /etc/systemd/system/k3s.service.env and set the following environment variables:
```
HTTP_PROXY=<proxy>
HTTPS_PROXY=<proxy info>
NO_PROXY=<localhost and other IPs that do not need proxy>
```
The <proxy info> format is http://<user>:<password>@<domain or IP address>:<port> where <user> and <password> are URL encoded strings.
For example:
```
HTTP_PROXY=http://proxy.corp.com:8080
HTTPS_PROXY=http://proxy.corp.com:8080
NO_PROXY=localhost,127.0.0.1,localaddress,corp.com,10.0.0.0/8
```
The following example shows proxy authentication assuming the user name is user1 and password is p@ssword:
```
HTTP_PROXY=http://user1:p%40ssword@proxy.corp.com:8080 &&
HTTPS_PROXY=http://user1:p%40ssword@proxy.corp.com:8080 &&
NO_PROXY=localhost,127.0.0.1,localaddress,corp.com,10.0.0.0/8
```
Note: The HTTP_PROXY and HTTPS_PROXY are redirects so you can have the HTTPS_PROXY redirect HTTPS traffic to an HTTP URL. Using TLS over a TLS connection (setting https:// in the proxy URL) is not necessary and is not currently supported.
Update the system's cacerts to trust the CA certificate from the proxy itself by adding the certificate in PEM encoding to /etc/pki/ca-trust/source/anchors, and then run:
```
sudo update-ca-trust
```
Restart the Kubernetes K3s:
```
sudo systemctl restart k3s
```
When the restart is done, enter the following command to list all of the system containers. Verify that their status is Running or Completed.
```
sudo kubectl get pods -n kube-system
```

Edge Gateway

Important: If you use a proxy server between the Edge Gateway and Orchestration & Automation, use the --https-proxy-url option. You can use --https-from-http with --http-proxy-url if the HTTP and HTTPS proxy are the same. The --http-proxy-url by itself is not supported.

If you use the --no-proxy option between the Edge Gateway and Orchestration & Automation, specify the fully qualified domain name (FQDN) or the IP address that is specified as the host in the app.config file. Wildcard and IP address ranges are not supported only between the Edge Gateway and Orchestration & Automation.

Configure the proxy settings for each instance of the Edge Gateway. If the Edge Gateway is not installed, use the manageAppHost install command instead of the manageAppHost proxy command.

If all the Edge Gateway is using the same proxy server as their host system, you can pull the proxy information from the system's environment with the following command.
```
manageAppHost proxy --environment
```
Configure the Edge Gateway to connect through the proxy using an HTTPS or HTTP connection, or both.
```
manageAppHost proxy --https-proxy-url http://<URL>:<port>
```
```
manageAppHost proxy --http-proxy-url http://<URL>:<port>
```
```
manageAppHost proxy --https-proxy-url http://<URL>:<port> --http-proxy-url http://<URL>:<port>
```
To configure the proxy connection with a user account for authentication, add --http-proxy-user <username> or --https-proxy-user <username>. You are prompted for the proxy password. The following command is an example of enabling authentication.
```
manageAppHost proxy --https-proxy-url http://<URL>:<port> --https-proxy-user <username>
```
If you have multiple paired Edge Gateways on the system, you are prompted to select the Edge Gateway to configure.

If you need to clear the proxy setting, use the following command:

manageAppHost proxy --clear

Apps

If an app requires a different or separate external internet connection, add the following section to its app.config file, which is accessible from the app in the Apps tab of the Orchestration & Automation application. Refer to the app's documentation and the Configuring apps for detailed information.

[integrations]
# To override, add any parameter to your specific integration section
http_proxy=<URL>:<port>
https_proxy=<URL>:<port>
timeout=120