Troubleshooting issues with KOTS install with a squid proxy

Supporting your customers
, ,
1

Great question from today:

I have a use case where I want to use a PROXY variable for deploying KOTS. I am using an external squid proxy for this purpose. It is configured for both HTTP & SSL sites.
When I try to deploy KOTS with:

kubectl kots install $REPLICATED_APP \
 --namespace $NAMESPACE \
 --shared-password $ADMIN_PASSWORD \
 --no-port-forward \
 --http-proxy http://x.x.x.x:3128

Admin portal comes up but it fails to load the certificate with error:

{"level":"error","ts":"2022-08-24T23:48:54Z","msg":"failed to get latest license: failed to execute get request: Get \"https://replicated.app/license/app-enterprise\": dial tcp 162.159.134.41:443: i/o timeout"}
{"level":"info","ts":"2022-08-24T23:48:54Z","msg":"method=POST status=500 duration=30.044787684s request=/api/v1/license"}

But if I deploy KOTS with explicit --https-proxy parameter:

kubectl kots install $REPLICATED_APP \
  --namespace $NAMESPACE \
  --shared-password $ADMIN_PASSWORD \
  --no-port-forward \
  --http-proxy http://x.x.x.x:3128 \
  --https-proxy https://x.x.x.x:3129

The kotsadm pod crashes with ERROR:

2022/08/24 23:41:42 Starting monitor loop
W0824 23:41:42.177964       1 reflector.go:324] k8s.io/client-go@v1.23.1-k3s1/tools/cache/reflector.go:167: failed to list *v1.Job: Get "https://172.20.0.1:443/apis/batch/v1/namespaces/app-system/jobs?limit=500&resourceVersion=0": proxyconnect tcp: EOF
E0824 23:41:42.178173       1 reflector.go:138] k8s.io/client-go@v1.23.1-k3s1/tools/cache/reflector.go:167: Failed to watch *v1.Job: failed to list *v1.Job: Get "https://172.20.0.1:443/apis/batch/v1/namespaces/app-system/jobs?limit=500&resourceVersion=0": proxyconnect tcp: EOF
2022/08/24 23:41:42 Shutting down the operator client
panic: failed to get server groups: Get "https://172.20.0.1:443/api": proxyconnect tcp: EOF

Could you help me with few troubleshooting steps that I could try at my end to make it run.

2

I think after adding https-proxy the k8s API connections are going there as well. Probably need to add --no-proxy as well.