goauthentik / goauthentik/authentik
Cannot connect Local Kubernetes Cluster integration when using https_proxy
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 651
Description
### Describe the bug
When I try to deploy an outpost or update existing the task fails because the worker process can't connect to Kubernetes API.
Although the no_proxy environment variables is set, the worker is not using it for Kubernetes API connetions. This is an example:
Environment:
HTTP_PROXY: http://proxy.example.com:8080
HTTPS_PROXY: http://proxy.example.com:8080
NO_PROXY: localhost,127.0.0.1,10.25.0.1,0.0.0.0,.svc
The KUBERNETES_SERVICE_HOST is 10.25.0.1, this is the reason the IP is included on NO_PROXY.
When I try to update the outpost, this is the error:
HTTPSConnectionPool(host='10.25.0.1', port=443): Max retries exceeded with url: /api/v1/namespaces/sso/secrets/ak-outpost-radius-infra (Caused by ProxyError('Unable to connect to proxy', OSError('Tunnel connection failed: 503 Service Unavailable')))
### How to reproduce
1. Configure HTTP proxy environment variables to access external services (as S3 buckets)
2. Try to deploy an Outpost in local Kubernetes cluster
### Expected behavior
Don't use HTTP proxy when connect to local kubernetes API to deploy outposts or get other information
### Screenshots
_No response_
### Additional context
_No response_
### Deployment Method
Kubernetes
### Version
2026.5.2, but older versions have the same problem
### Relevant log output
```shell
HTTPSConnectionPool(host='10.25.0.1', port=443): Max retries exceeded with url: /api/v1/namespaces/sso/secrets/ak-outpost-radius-infra (Caused by ProxyError('Unable to connect to proxy', OSError('Tunnel connection failed: 503 Service Unavailable')))
```
Contributor guide
Research direction
Start by locating the worker entry point that deploys or updates local Kubernetes outposts and inspect how its Kubernetes API client handles HTTP_PROXY and NO_PROXY. Reproduce the failure with the supplied environment variables and a local cluster; done means the worker connects directly to the Kubernetes API while retaining proxy access for external services.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes, python
- Domain
- backend, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100