Skip to content

Authentication proxyNew#

Starting with MKE 4.2.1, you can route MKE 4 outbound authentication traffic through an HTTP or HTTPS proxy, to allow a cluster without direct internet egress to continue to reach an external identity provider (IdP). You configure the proxy either through the authentication.proxy section of the mke4.yaml configuration file or by way of the MKE 4 Dashboard.

Note

  • The authentication proxy applies to the outbound OIDC and SAML traffic of MKE 4 only. It does not apply to LDAP, and it does not affect the browser of the end user, which continues to directly connect with the identity provider.
  • By default, the authentication proxy is disabled, and it can only be enabled when OIDC or SAML is enabled.

Configure the authentication proxy with mke4.yaml#

Configure spec.authentication.proxy so that MKE 4 routes authentication traffic through an HTTP or HTTPS proxy:

spec:
  authentication:
    proxy:
      enabled: true
      url: http://proxy.example.com:3128
      noProxy:
        - idp.internal.example.com
        - 10.0.0.0/8
Field                     Type                     Description
enabled boolean Determines whether authentication traffic is routed through the proxy.

Default: false
url string Proxy address, as an absolute http:// or https:// URL that includes the host. Required when enabled is true.

The URL must not include a username or password.
noProxy list of strings Additional hosts, domains, or CIDRs to reach directly rather than through the proxy. The entries are added to the exclusions that MKE 4 applies automatically. Entries cannot be empty.

MKE 4 automatically excludes localhost and in-cluster destinations from proxying, including Kubernetes service names, .svc, .cluster.local, and the cluster service and pod networks. Anything listed in noProxy is added to these default exclusions.

If the proxy requires authentication, supply the proxy username and password through the cluster authentication credentials Secret. Do not embed credentials in the configuration file. The method depends on whether the cluster already exists:

  • Existing cluster: Create or update the Secret directly, or set the credentials in the MKE 4 Dashboard.

  • New cluster: Pass the credentials through environment variables when you run the first mkectl apply command.

Supply proxy credentials to an existing MKE 4 cluster#

For an existing MKE 4 cluster, supply the proxy credentials through the Secret that authentication.credentialsSecretName references. Do not embed credentials in proxy.url as MKE 4 rejects any proxy.url value that contains credentials. Refer to Supply authentication credentials for information on the Secret and how to reference it.

Add the following keys to the Secret:

Key Description
proxyUsername Proxy username
proxyPassword Proxy password

Warning

Supply both keys together. MKE 4 rejects a Secret that contains only one of the two keys. For a proxy that does not require authentication, omit both keys.

Supply proxy credentials with the first mkectl apply command#

During initial installation, the cluster does not yet exist and cannot hold the Secret that authentication.credentialsSecretName references. Instead, export the proxy credentials as environment variables on the mkectl host before you run the first mkectl apply command.

Environment variable Populates Secret key
AUTH_PROXY_USERNAME proxyUsername
AUTH_PROXY_PASSWORD proxyPassword

  1. Export the proxy credentials:

        export AUTH_PROXY_USERNAME='<proxy-username>'
    export AUTH_PROXY_PASSWORD='<proxy-password>'

  2. Apply the configuration:

        mkectl apply -f mke4.yaml

When the proxy is enabled and authentication.credentialsSecretName is set, mkectl apply creates the referenced Secret if it does not exist and populates the proxyUsername and proxyPassword keys from the environment variables. If the Secret already exists, mkectl apply does not modify its proxy keys.

After the first mkectl apply, manage the proxyUsername and proxyPassword keys directly in the Secret. Refer to Supply proxy credentials to an existing MKE 4 cluster.

Info

If you set ssoMetadataURL for SAML, mkectl retrieves the SAML metadata through the configured proxy when you run mkectl apply and uses the same environment variables to authenticate to the proxy. The metadata endpoint must be reachable from the mkectl host, either directly or through the proxy.

Configure the authentication proxy with the MKE 4 Dashboard#

  1. Log in to the MKE 4 Dashboard as an administrator.

  2. Navigate to Admin Settings --> Authentication --> Proxy.

  3. Select the enable authentication proxy checkbox.

  4. Configure the proxy settings:

    1. In the proxy URL field, enter the absolute http:// or https:// URL of the proxy, including the host. For example, http://proxy.example.com:3128. Do not embed credentials in the URL.

    2. Optional. In the no-proxy exclusions field, enter a host, domain, or CIDR that must bypass the proxy, and then click the plus icon. Repeat for each destination.

    3. Optional. If your proxy requires authentication, enter the proxy credentials in the username and password fields. You must provide both values.

  5. Click save settings.

The Dashboard writes the proxy username and password to the cluster authentication credentials Secret, and creates the Secret if it does not exist.

View credential status#

The Credentials heading shows whether credentials are currently stored:

  • configured: The Secret contains a username, a password, or both.
  • none: The Secret contains neither a username nor a password.

Info

The Dashboard never displays the stored password. To change other proxy settings without re-entering the password, leave the password field blank. The Dashboard preserves the stored password.

Remove authentication proxy credentials#

You can stop MKE from authenticating to the proxy by removing the proxy credentials.

  1. Navigate to Admin Settings --> Authentication --> Proxy.

  2. Click clear credentials in the Credentials section.

  3. Click yes, clear credentials to confirm.

MKE 4 removes the username and password from the authentication credentials Secret, and the Credentials heading displays none.

Child clusters#

The same authentication.proxy configuration is available on MkeChildConfig. For a child cluster, the proxy credentials are taken from the child cluster's authentication credentials Secret, which is the Secret referenced by credentialsSecretName in the same namespace as the child cluster configuration object. Refer to Authentication options for more information.