Automate Proxy Injection in EKS Fargate with Kyverno

In a world where cloud-native applications need to communicate securely and efficiently, managing proxy settings can become a cumbersome task. Manually adding proxy environment variables to each container in your deployment manifests is not only error-prone but also time-consuming. Automating this process with Kyverno allows you to enforce consistent proxy settings across your pods, enhancing security and simplifying your deployment workflow.

Kyverno operates as a mutating admission webhook within your Kubernetes cluster. When a pod creation request is made, the API server sends an AdmissionReview to Kyverno. If the pod's namespace is labeled with proxy-injection: enabled, Kyverno injects the necessary HTTPS_PROXY, HTTP_PROXY, and NO_PROXY environment variables into every container and init container at admission time. This means that your applications will start with the correct proxy settings already in place, allowing them to route outbound calls through the corporate proxy without additional configuration. The failurePolicy: Ignore setting ensures that pod scheduling is not blocked if the webhook is temporarily unavailable, maintaining your deployment's reliability.

In production, ensure that your Fargate profiles are correctly configured to match CoreDNS, Kyverno, and any other pods you schedule. Be aware that while CIDR ranges in NO_PROXY are honored by some clients, others like curl and libcurl may not behave as expected. This can lead to unexpected behavior if your applications rely on these tools for outbound communication. Always verify your proxy settings and test your applications thoroughly to avoid connectivity issues.