goauthentik / goauthentik/authentik

Cannot connect Local Kubernetes Cluster integration when using https_proxy

Open
#22,806 4 comments 0 reactions 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

### Describe the bug

When I try to deploy an outpost or update existing the task fails because the worker process can't connect to Kubernetes API.

Although the no_proxy environment variables is set, the worker is not using it for Kubernetes API connetions. This is an example:
Environment:
HTTP_PROXY: http://proxy.example.com:8080
HTTPS_PROXY: http://proxy.example.com:8080
NO_PROXY: localhost,127.0.0.1,10.25.0.1,0.0.0.0,.svc

The KUBERNETES_SERVICE_HOST is 10.25.0.1, this is the reason the IP is included on NO_PROXY.

When I try to update the outpost, this is the error:
HTTPSConnectionPool(host='10.25.0.1', port=443): Max retries exceeded with url: /api/v1/namespaces/sso/secrets/ak-outpost-radius-infra (Caused by ProxyError('Unable to connect to proxy', OSError('Tunnel connection failed: 503 Service Unavailable')))

### How to reproduce

1. Configure HTTP proxy environment variables to access external services (as S3 buckets)
2. Try to deploy an Outpost in local Kubernetes cluster

### Expected behavior

Don't use HTTP proxy when connect to local kubernetes API to deploy outposts or get other information

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Kubernetes

### Version

2026.5.2, but older versions have the same problem

### Relevant log output

```shell
HTTPSConnectionPool(host='10.25.0.1', port=443): Max retries exceeded with url: /api/v1/namespaces/sso/secrets/ak-outpost-radius-infra (Caused by ProxyError('Unable to connect to proxy', OSError('Tunnel connection failed: 503 Service Unavailable')))
```

Contributor guide

Open the contributing guide

Research direction

Start by locating the worker entry point that deploys or updates local Kubernetes outposts and inspect how its Kubernetes API client handles HTTP_PROXY and NO_PROXY. Reproduce the failure with the supplied environment variables and a local cluster; done means the worker connects directly to the Kubernetes API while retaining proxy access for external services.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes, python
Domain
backend, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.