MG-66: Update egress proxy behaviour for support-log-gather operator #1903

praveencodes · 2025-12-10T06:45:27Z

Removed the proxy config from CR and use the cluster-wide proxy env vars propagated through OLM. Added information on the support for Certificate Authority (CA) in the must gather operator.

openshift-ci-robot · 2025-12-10T06:45:31Z

@praveencodes: This pull request references MG-66 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

praveencodes · 2025-12-10T07:03:32Z

/cc @shivprakashmuley @swghosh

swghosh · 2025-12-10T07:17:49Z

enhancements/support-log-gather/must-gather-operator.md


-`mustgather.spec.proxyConfig` if set by the user in the CR, will be propagated as pod environment variables to the gather and upload containers of the Job. The configuration set in the resource is given precedence over the cluster-wide proxy settings set on the cluster through `configv1.Proxy` object. Due to the nature of SOCKS proxy protocol and the HTTP "CONNECT" verb in most proxy servers used with OpenShift, the upload process using SFTP's TCP can essentially make a CONNECT request over netcat and intercept to upload the mustgather bundle even when on a airgapped proxy setup.
+The operator inherits cluster-wide proxy settings (typically propagated from the configv1.Proxy object via the operator's environment variables) and passes them to the upload container of the Job. The upload process uses an HTTP CONNECT proxy via netcat (nc --proxy-type http) as an SSH ProxyCommand, allowing SFTP traffic to tunnel through HTTP proxies commonly used in airgapped OpenShift environments.
+


Let's also mention that the cluster-wide proxy env vars are propagated/managed through OLM directly. If the user wishes to customise it, a cluster-admin can override the HTTP_PROXY, HTTPS_PROXY, NO_PROXY env vars through the OLM Subscription object.

swghosh

we should include that the trusted CA config map is copied from the operator to the operand namespace where MustGather CR is present. And, additionally discuss if it should add an ownerReference, given the copied config map will be created by the operator.

swghosh · 2025-12-10T10:40:43Z

enhancements/support-log-gather/must-gather-operator.md

+## Configuring egress proxy for Must Gather Operator
+
+If a cluster wide egress proxy is configured on the OpenShift cluster, OLM automatically update all the operators' deployments with `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY` environment variables.  
+Those variables are then propagated down to the must gather (operand) controllers by the must gather operator.
+
+### Trusted Certificate Authority
+
+#### Running operator
+
+Follow the instructions below to let Must Gather Operator trust a custom Certificate Authority (CA). The operator's OLM subscription has to be already created.


I don't think we need a doc-style instructions in here,

Updated it.

swghosh · 2025-12-10T10:41:52Z

enhancements/support-log-gather/must-gather-operator.md

+## Configuring egress proxy for Must Gather Operator
+
+If a cluster wide egress proxy is configured on the OpenShift cluster, OLM automatically update all the operators' deployments with `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY` environment variables.  
+Those variables are then propagated down to the must gather (operand) controllers by the must gather operator.


probably, a li'l confusing which "operand controllers" are being referred?

Changed it.

swghosh · 2025-12-10T19:33:08Z

/retitle MG-66: Update egress proxy behaviour for support-log-gather operator

… in configmap.

praveencodes · 2025-12-15T12:34:10Z

we should include that the trusted CA config map is copied from the operator to the operand namespace where MustGather CR is present. And, additionally discuss if it should add an ownerReference, given the copied config map will be created by the operator.

Added the configmap copying and ownerReference.

swghosh

/lgtm

also, as a good practice consider adding a suitable PR description.

swghosh · 2025-12-16T14:05:40Z

enhancements/support-log-gather/must-gather-operator.md

+
+### Trusted Certificate Authority
+
+The operator supports custom Certificate Authority (CA) bundles for environments using proxy servers with TLS interception. When the `TRUSTED_CA_CONFIGMAP_NAME` environment variable is set on the operator deployment (via OLM Subscription or direct patch), the operator mounts the referenced ConfigMap containing the CA bundle at `/etc/pki/tls/certs/must-gather-tls-ca-bundle.crt`. This ConfigMap should be labeled with `config.openshift.io/inject-trusted-cabundle=true` to leverage OpenShift's [CA bundle injection](https://docs.openshift.com/container-platform/4.12/networking/configuring-a-custom-pki.html#certificate-injection-using-operators_configuring-a-custom-pki).


Suggested change

The operator supports custom Certificate Authority (CA) bundles for environments using proxy servers with TLS interception. When the `TRUSTED_CA_CONFIGMAP_NAME` environment variable is set on the operator deployment (via OLM Subscription or direct patch), the operator mounts the referenced ConfigMap containing the CA bundle at `/etc/pki/tls/certs/must-gather-tls-ca-bundle.crt`. This ConfigMap should be labeled with `config.openshift.io/inject-trusted-cabundle=true` to leverage OpenShift's [CA bundle injection](https://docs.openshift.com/container-platform/4.12/networking/configuring-a-custom-pki.html#certificate-injection-using-operators_configuring-a-custom-pki).

The operator supports custom Certificate Authority (CA) bundles for environments using proxy servers with TLS interception. When the `TRUSTED_CA_CONFIGMAP_NAME` environment variable is set on the operator deployment (via OLM Subscription or direct patch), the operator mounts the referenced ConfigMap containing the CA bundle at `/etc/pki/tls/certs/ca-bundle.crt`. This ConfigMap should be labeled with `config.openshift.io/inject-trusted-cabundle=true` to leverage OpenShift's [CA bundle injection](https://docs.openshift.com/container-platform/4.12/networking/configuring-a-custom-pki.html#certificate-injection-using-operators_configuring-a-custom-pki).

Small nit, shouldn’t be blocking though.

openshift-ci · 2025-12-16T14:06:22Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: swghosh
Once this PR has been reviewed and has the lgtm label, please assign joelanford for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

swghosh · 2025-12-16T14:07:38Z

/assign @shivprakashmuley

/cc @Prashanth684 / @TrilokGeer
for approvals.

openshift-ci · 2025-12-16T14:07:43Z

@swghosh: GitHub didn't allow me to request PR reviews from the following users: /.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

/assign @shivprakashmuley

/cc @Prashanth684 / @TrilokGeer
for approvals.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

shivprakashmuley · 2025-12-17T09:44:16Z

/lgtm

openshift-ci-robot · 2025-12-17T09:46:52Z

@praveencodes: This pull request references MG-66 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Removed the proxy config from CR and use the cluster-wide proxy env vars propagated through OLM. Added information on the support for Certificate Authority (CA) in the must gather operator.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2025-12-17T09:47:07Z

@praveencodes: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

MG-66: Remove the proxy config from CR

b31879d

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Dec 10, 2025

openshift-ci bot requested review from bradmwilliams and enxebre December 10, 2025 06:45

openshift-ci bot requested review from shivprakashmuley and swghosh December 10, 2025 07:03

swghosh reviewed Dec 10, 2025

View reviewed changes

add Trusted CA information

c0c5c38

swghosh suggested changes Dec 10, 2025

View reviewed changes

openshift-ci bot changed the title ~~MG-66: Remove the proxy config from CR~~ MG-66: Update egress proxy behaviour for support-log-gather operator Dec 10, 2025

remove doc style instructions and add EP style and add ownerReference…

d86f81b

… in configmap.

swghosh approved these changes Dec 16, 2025

View reviewed changes

openshift-ci bot assigned swghosh Dec 16, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 16, 2025

openshift-ci bot assigned shivprakashmuley Dec 16, 2025

openshift-ci bot requested review from Prashanth684 and TrilokGeer December 16, 2025 14:07

change the crt name

1f91340

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Dec 17, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 17, 2025


		`mustgather.spec.proxyConfig` if set by the user in the CR, will be propagated as pod environment variables to the gather and upload containers of the Job. The configuration set in the resource is given precedence over the cluster-wide proxy settings set on the cluster through `configv1.Proxy` object. Due to the nature of SOCKS proxy protocol and the HTTP "CONNECT" verb in most proxy servers used with OpenShift, the upload process using SFTP's TCP can essentially make a CONNECT request over netcat and intercept to upload the mustgather bundle even when on a airgapped proxy setup.
		The operator inherits cluster-wide proxy settings (typically propagated from the configv1.Proxy object via the operator's environment variables) and passes them to the upload container of the Job. The upload process uses an HTTP CONNECT proxy via netcat (nc --proxy-type http) as an SSH ProxyCommand, allowing SFTP traffic to tunnel through HTTP proxies commonly used in airgapped OpenShift environments.


		### Trusted Certificate Authority

		The operator supports custom Certificate Authority (CA) bundles for environments using proxy servers with TLS interception. When the `TRUSTED_CA_CONFIGMAP_NAME` environment variable is set on the operator deployment (via OLM Subscription or direct patch), the operator mounts the referenced ConfigMap containing the CA bundle at `/etc/pki/tls/certs/must-gather-tls-ca-bundle.crt`. This ConfigMap should be labeled with `config.openshift.io/inject-trusted-cabundle=true` to leverage OpenShift's [CA bundle injection](https://docs.openshift.com/container-platform/4.12/networking/configuring-a-custom-pki.html#certificate-injection-using-operators_configuring-a-custom-pki).

MG-66: Update egress proxy behaviour for support-log-gather operator #1903

Are you sure you want to change the base?

MG-66: Update egress proxy behaviour for support-log-gather operator #1903

Uh oh!

Conversation

praveencodes commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Dec 10, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

praveencodes commented Dec 10, 2025

Uh oh!

swghosh Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

swghosh left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

swghosh Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

praveencodes Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

swghosh Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

praveencodes Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

swghosh commented Dec 10, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

praveencodes commented Dec 15, 2025

Uh oh!

swghosh left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

swghosh Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Dec 16, 2025

Uh oh!

swghosh commented Dec 16, 2025

Uh oh!

openshift-ci bot commented Dec 16, 2025

Uh oh!

shivprakashmuley commented Dec 17, 2025

Uh oh!

openshift-ci-robot commented Dec 17, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Dec 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

praveencodes commented Dec 10, 2025 •

edited

Loading

openshift-ci-robot commented Dec 10, 2025 •

edited by openshift-ci bot

Loading

swghosh left a comment •

edited

Loading

swghosh commented Dec 10, 2025 •

edited by openshift-ci bot

Loading

swghosh left a comment •

edited

Loading

openshift-ci-robot commented Dec 17, 2025 •

edited by openshift-ci bot

Loading