Configuring a proxy server
July 12, 2024
ID 274394
In version 1.2, Kaspersky Container Security can proxy requests from private corporate networks to the external environment. The settings for connection through a proxy server are configured using the following environment variables in the Helm Chart package, which is included in the solution distribution kit:
HTTP_PROXY
– proxy server for HTTP requests.HTTPS_PROXY
– proxy server for HTTPS requests.NO_PROXY
– a variable that specifies domains or domain masks to be excluded from proxying.If you specify
NO_PROXY
, the variable can include any domains and masks you need, but it must also contain the following values:localhost
,kcs-licenses
,kcs-scanner-api
,kcs-pgbouncer
,kcs-mw-grpc
,kcs-scanner
,kcs-s3
,kcs-middleware
,kcs-updates
,kcs-event-broker
,kcs-clickhouse
,kcs-eb
.The specified mandatory settings mean the following:
localhost
– domain name of a private IP address.kcs-licenses
– module for managing functionality provided under the license.kcs-scanner-api
– name of the scan API server.kcs-pgbouncer
– the application that manages a PostgreSQL connection pool and connects to the server.kcs-mw-grpc
– indication of the API system for remote procedure calls.kcs-scanner
– scanner server, which is used to store the vulnerability database and the image layer cache, and acts as the server for kcs-ih modules.kcs-s3
– name of the S3-compatible file storage repository used to store files generated by Kaspersky Container Security and distribute them to users.kcs-middleware
– indication of the server component of the solution, which facilitates data processing and provides a REST API for the graphical interface.kcs-updates
– indication of the update repository used when deploying the solution in isolated segments of the corporate network.kcs-event-broker
– component that acts as an intermediary between various elements of the distributed Kaspersky Container Security system.kcs-clickhouse
– indication of the ClickHouse database management system, which stores and processes informational messages from node-agent system agents.kcs-eb
– Indication of the AWS Elastic Beanstalk system for deployment and scaling of web applications.
The
NO_PROXY
variable must be specified when usingHTTP_PROXY
and/orHTTPS_PROXY
.SCANNER_PROXY
– a specialized variable that specifies which proxy server receives requests from the scanner of the File Threat Protection component. These requests are used by Kaspersky servers to update databases.LICENSE_PROXY
– a specialized variable that specifies the proxy server through which kcs-licenses module sends requests to Kaspersky servers to check and update information about the current license.
To specify Kaspersky servers in the permission lists of proxy servers, you must use a *.kaspersky.com
or .kaspersky.com
mask (depending on the domain name masks supported by your proxy server).
The table below lists the Kaspersky Container Security components that can use environment variables, and also indicates the purpose of these environment variables.
Environment variables used by Kaspersky Container Security components
Component | Environment variable | Purpose |
---|---|---|
kcs-ih |
| Getting access to external image registries that are not available from the Kaspersky Container Security namespace. |
kcs-ih |
| Update of the databases of the File Threat Protection scanner using Kaspersky update servers. |
kcs-middleware |
| Getting access to external image registries that are not available from the Kaspersky namespace. |
kcs-scanner |
| Update of the vulnerability scanner databases using Kaspersky update servers. |
kcs-licenses |
| Check and update of information about the current license using Kaspersky license servers. |