Setting Proxy for rancher/mirrored-elemental-seedimage-builder

[steffenba]

When the operator creates the pod containing the baseiso container via fleet, there is no way to provide proxy configuration either via rancher, or via Helm that I could find.
The Containing K3s node does of course not inject any proxy variables into the container, and I would prefer not to create an admission-controller if at all possible.

The documents in https://elemental.docs.rancher.com/elemental_behind_proxy/ only describe adjustments that concern Nodes or Clusters running a completed image, not how to configure the baseiso container.

I apologize if I am missing something obvious, but I see no way to configure this behaviour, or injecting a /etc/sysconfig/proxy file into the baseiso container.

[benjulios]

You can workaround the issue by injecting proxy env vars with an Admission mutation .
As rancher doesn't include Native MutationPolicy (CEL) . install kyverno

helm repo add kyverno https://kyverno.github.io/kyverno/
helm repo update

and create a targeted mutation

SeedimageClusterPolicy.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: inject-proxy-to-seedimage-builders
spec:
  background: false
  rules:
  - name: inject-env-vars
    match:
      any:
      - resources:
          kinds:
          - Pod
          namespaces:
          - fleet-default
          selector:
            matchLabels:
              app.kubernetes.io/name: "media-image-reg*"
    mutate:
      patchStrategicMerge:
        spec:
          initContainers:
          - (name): "baseiso"
            env:
            - name: HTTP_PROXY
              value: "http://<yourproxy>"
            - name: HTTPS_PROXY
              value: "http://<yourproxy>"
            - name: NO_PROXY
              value: "localhost,127.0.0.1,10.43.0.0/16,kubernetes.default.svc,<yourproxydomain_if_fqdn>"

works great