[2317] Auth for http(s) proxy

deploy/05controller-deployment.yaml

@@ -42,6 +42,9 @@ spec:
         - configMapRef:
             name: pf9-env
             optional: true
+        - secretRef:
+            name: pf9-proxy-creds
+            optional: true
         image: quay.io/platform9/vjailbreak-controller:main
         imagePullPolicy: IfNotPresent
         lifecycle:

deploy/06vpwned-deployment.yaml

@@ -38,6 +38,9 @@ spec:
         - configMapRef:
             name: pf9-env
             optional: true
+        - secretRef:
+            name: pf9-proxy-creds
+            optional: true
         image: quay.io/platform9/vjailbreak-vpwned:main
         imagePullPolicy: IfNotPresent
         name: vpwned

deploy/installer.yaml

@@ -5220,6 +5220,9 @@ spec:
         - configMapRef:
             name: pf9-env
             optional: true
+        - secretRef:
+            name: pf9-proxy-creds
+            optional: true
         image: quay.io/platform9/vjailbreak-controller:main
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -5325,6 +5328,9 @@ spec:
         - configMapRef:
             name: pf9-env
             optional: true
+        - secretRef:
+            name: pf9-proxy-creds
+            optional: true
         image: quay.io/platform9/vjailbreak-vpwned:main
         imagePullPolicy: IfNotPresent
         name: vpwned

k8s/migration/config/addons/k8s.svc.yaml

@@ -69,6 +69,9 @@ spec:
         - configMapRef:
             name: pf9-env
             optional: true
+        - secretRef:
+            name: pf9-proxy-creds
+            optional: true
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:

k8s/migration/config/manager/manager.yaml

@@ -71,6 +71,9 @@ spec:
           - configMapRef:
               name: pf9-env
               optional: true
+          - secretRef:
+              name: pf9-proxy-creds
+              optional: true
         args:
           - --leader-elect=false
           - --health-probe-bind-address=:8081

k8s/migration/internal/controller/migrationplan_controller.go

@@ -1294,6 +1294,14 @@ func (r *MigrationPlanReconciler) CreateJob(ctx context.Context,
 											},
 										},
 									})
+									envFrom = append(envFrom, corev1.EnvFromSource{
+										SecretRef: &corev1.SecretEnvSource{
+											LocalObjectReference: corev1.LocalObjectReference{
+												Name: "pf9-proxy-creds",
+											},
+											Optional: &pointtrue,
+										},
+									})
 									return envFrom
 								}(),
 								VolumeMounts: []corev1.VolumeMount{

pkg/common/utils/net.go

@@ -26,6 +26,27 @@ type VjbNet struct {
 	NoProxy         string
 	UseProxyFromEnv bool
 	proxyCfg        *httpproxy.Config
+
+	HTTPProxyUsername  string
+	HTTPProxyPassword  string
+	HTTPSProxyUsername string
+	HTTPSProxyPassword string
+}
+
+func withProxyCredentials(rawURL, username, password string) string {
+	if rawURL == "" || username == "" {
+		return rawURL
+	}
+	u, err := url.Parse(rawURL)
+	if err != nil || u.Host == "" {
+		u2, err2 := url.Parse("http://" + rawURL)
+		if err2 != nil || u2.Host == "" {
+			return rawURL
+		}
+		u = u2
+	}
+	u.User = url.UserPassword(username, password)
+	return u.String()
 }
 
 func (v *VjbNet) getNetTransport(tlsConfig *tls.Config) *http.Transport {
@@ -53,11 +74,14 @@ func (v *VjbNet) getNetTransport(tlsConfig *tls.Config) *http.Transport {
 		}
 
 		transport.Proxy = func(req *http.Request) (*url.URL, error) {
-			proxyURL, err := v.proxyCfg.ProxyFunc()(req.URL)
+			cfg := *v.proxyCfg
+			cfg.HTTPProxy = withProxyCredentials(cfg.HTTPProxy, v.HTTPProxyUsername, v.HTTPProxyPassword)
+			cfg.HTTPSProxy = withProxyCredentials(cfg.HTTPSProxy, v.HTTPSProxyUsername, v.HTTPSProxyPassword)
+
+			proxyURL, err := cfg.ProxyFunc()(req.URL)
 			if err != nil {
 				return nil, err
 			}
-			// Preserve existing logging behavior.
 			if proxyURL != nil {
 				fmt.Printf("Proxy config: HTTPProxy=%s, HTTPSProxy=%s, NoProxy=%s\n",
 					v.proxyCfg.HTTPProxy, v.proxyCfg.HTTPSProxy, v.proxyCfg.NoProxy)
@@ -80,9 +104,6 @@ func (v *VjbNet) CreateHTTPClient() error {
 	}
 	transport := v.getNetTransport(tlsConfig)
 
-	if v.UseProxyFromEnv {
-		transport.Proxy = http.ProxyFromEnvironment
-	}
 	v.Client = &http.Client{
 		Transport: transport,
 		Timeout:   v.timeout,
@@ -102,10 +123,6 @@ func (v *VjbNet) CreateSecureHTTPClient() error {
 
 	transport := v.getNetTransport(tlsConfig)
 
-	if v.UseProxyFromEnv {
-		transport.Proxy = http.ProxyFromEnvironment
-	}
-
 	v.Client = &http.Client{
 		Transport: transport,
 		Timeout:   v.timeout,
@@ -137,6 +154,16 @@ func (v *VjbNet) SetUseProxyFromEnv(use bool) {
 	v.UseProxyFromEnv = use
 }
 
+func (v *VjbNet) SetHTTPProxyCredentials(username, password string) {
+	v.HTTPProxyUsername = username
+	v.HTTPProxyPassword = password
+}
+
+func (v *VjbNet) SetHTTPSProxyCredentials(username, password string) {
+	v.HTTPSProxyUsername = username
+	v.HTTPSProxyPassword = password
+}
+
 func (v *VjbNet) GetClient() *http.Client {
 	return v.Client
 }
@@ -157,9 +184,14 @@ func (v *VjbNet) proxy4URL(reqURL *url.URL) (*url.URL, error) {
 	if v.NoProxy != "" {
 		v.proxyCfg.NoProxy = v.NoProxy
 	}
+
+	cfg := *v.proxyCfg
+	cfg.HTTPProxy = withProxyCredentials(cfg.HTTPProxy, v.HTTPProxyUsername, v.HTTPProxyPassword)
+	cfg.HTTPSProxy = withProxyCredentials(cfg.HTTPSProxy, v.HTTPSProxyUsername, v.HTTPSProxyPassword)
+
 	// Delegate proxy decision to httpproxy's ProxyFunc for correct
 	// NO_PROXY and scheme handling.
-	proxyURL, err := v.proxyCfg.ProxyFunc()(reqURL)
+	proxyURL, err := cfg.ProxyFunc()(reqURL)
 	if err != nil {
 		return nil, err
 	}
@@ -207,6 +239,11 @@ func NewVjbNet() *VjbNet {
 		NoProxy:         "",
 		UseProxyFromEnv: true,
 		proxyCfg:        httpproxy.FromEnvironment(),
+
+		HTTPProxyUsername:  os.Getenv("HTTP_PROXY_USERNAME"),
+		HTTPProxyPassword:  os.Getenv("HTTP_PROXY_PASSWORD"),
+		HTTPSProxyUsername: os.Getenv("HTTPS_PROXY_USERNAME"),
+		HTTPSProxyPassword: os.Getenv("HTTPS_PROXY_PASSWORD"),
 	}
 }