Feat/falco proxy env #918

jvlerner · 2025-10-03T19:34:18Z

What type of PR is this?

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

If this PR will release a new chart version please make sure to also uncomment the following line:

/kind chart-release

Any specific area of the project related to this PR?

/area falco-chart

/area falcosidekick-chart

/area falco-talon-chart

/area event-generator-chart

/area k8s-metacollector-chart

What this PR does / why we need it:

Which issue(s) this PR fixes:

Currently, in environments with restricted internet access, containers often fail to reach external resources due to missing proxy configuration. This impacts components like falcoctl, which require outbound connectivity to fetch artifacts or updates.
This PR introduces support for injecting proxy-related environment variables (HTTP_PROXY, HTTPS_PROXY, NO_PROXY) into all relevant containers and initContainers when proxy is enabled via values.yaml.
The implementation uses a reusable Helm helper to ensure consistency and maintainability across templates.

Fixes #917

Special notes for your reviewer:

Default behavior remains unchanged if proxy values are not set.

Checklist

Chart Version bumped
Variables are documented in the README.md
CHANGELOG.md updated

poiana · 2025-10-03T19:34:22Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jvlerner
Once this PR has been reviewed and has the lgtm label, please assign cpanato for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

poiana · 2025-10-03T19:34:27Z

Welcome @jvlerner! It looks like this is your first PR to falcosecurity/charts 🎉

Signed-off-by: jvlerner <jvlerner@uolinc.com>

charts/falco/values.yaml

Signed-off-by: jvlerner <jvlerner@uolinc.com>

jvlerner · 2025-10-09T02:06:12Z

My bad guys, I missed adding the proxy link to the ignore list. Just fixed it
Would appreciate another review

ekoops

Hey, I overall looks good! I just added some comments. Let me know if you have any question or doubt! 😄

ekoops · 2025-10-09T08:37:23Z

charts/falco/templates/_helpers.tpl

  env:
-  {{- include "falco.renderTemplate" ( dict "value" .Values.falcoctl.artifact.install.env "context" $) | nindent 4 }}
+  {{- include "falco.proxyEnv" . | nindent 2 }}
+  {{- if .Values.falcoctl.artifact.install.env }}


Is this if statement required here? I have hadn't chance to check it, but what happen if we render an empty env list?

ekoops · 2025-10-09T08:38:57Z

charts/falco/templates/_helpers.tpl

+  {{- include "falco.proxyEnv" . | nindent 2 }}
  {{- include "falco.renderTemplate" ( dict "value" .Values.falcoctl.artifact.follow.env "context" $) | nindent 4 }}


Similarly to my previous comment, is there any reason why you didn't add the {{- if .Values.falcoctl.artifact.install.env }} check here?

ekoops · 2025-10-09T08:42:31Z

charts/falco/templates/pod-template.tpl

+      {{- if .Values.proxy.enabled }}
+      {{- include "falco.proxyEnv" . | nindent 8 }}
+      {{- end }}


You are already checking {{- if .Values.proxy.enabled }} in the helper. At this point, do we want to keep the check in the helper or do we want to repeat it? I guess it is better to remove it from the helper, but I'm open to other opinion on this!

ekoops · 2025-10-09T08:42:39Z

charts/falco/templates/pod-template.tpl

+  {{- if .Values.proxy.enabled }}
+  {{- include "falco.proxyEnv" . | nindent 4 }}
+  {{- end }}


Same as above

ekoops · 2025-10-09T08:43:55Z

charts/falco/README.md

+| proxy.http | string | `"http://proxy.dominio.com:3128"` | HTTP proxy URL used for outbound HTTP requests. |
+| proxy.https | string | `"http://proxy.dominio.com:3128"` | HTTPS proxy URL used for outbound HTTPS requests. |


Sorry, I guess my missed these two here in the previous review cycle 😔

leogr · 2025-10-31T10:25:51Z

Hey @jvlerner any update on this?

poiana added kind/feature New feature or request dco-signoff: no kind/chart-release Add this label when the chart version has been bumped labels Oct 3, 2025

poiana added the area/falco-chart label Oct 3, 2025

poiana requested review from bencer and ekoops October 3, 2025 19:34

github-project-automation bot added this to Falco Roadmap Oct 3, 2025

github-project-automation bot moved this to Todo in Falco Roadmap Oct 3, 2025

poiana added the size/M label Oct 3, 2025

jvlerner force-pushed the feat/falco-proxy-env branch from a570359 to 952d4f1 Compare October 3, 2025 19:36

feat(proxy): support proxy env injection across all containers

eb05963

Signed-off-by: jvlerner <jvlerner@uolinc.com>

jvlerner force-pushed the feat/falco-proxy-env branch from 952d4f1 to a2449e7 Compare October 3, 2025 19:40

poiana added dco-signoff: yes and removed dco-signoff: no labels Oct 3, 2025

jvlerner force-pushed the feat/falco-proxy-env branch 2 times, most recently from 42467d8 to b133844 Compare October 3, 2025 19:52

chore(falco): update chart version, docs and changelog

0edbf77

Signed-off-by: jvlerner <jvlerner@uolinc.com>

jvlerner force-pushed the feat/falco-proxy-env branch from b133844 to 0edbf77 Compare October 3, 2025 19:56

leogr reviewed Oct 6, 2025

View reviewed changes

charts/falco/values.yaml Outdated Show resolved Hide resolved

poiana added dco-signoff: no and removed dco-signoff: yes labels Oct 9, 2025

jvlerner force-pushed the feat/falco-proxy-env branch from 29f8ff2 to d46bc4f Compare October 9, 2025 02:00

chore: add to .lycheeignore proxy link

12691a9

Signed-off-by: jvlerner <jvlerner@uolinc.com>

jvlerner force-pushed the feat/falco-proxy-env branch from d46bc4f to 12691a9 Compare October 9, 2025 02:02

poiana added dco-signoff: yes and removed dco-signoff: no labels Oct 9, 2025

ekoops requested changes Oct 9, 2025

View reviewed changes

github-project-automation bot moved this from Todo to In progress in Falco Roadmap Oct 9, 2025

poiana assigned ekoops Oct 9, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Feat/falco proxy env #918

Feat/falco proxy env #918

jvlerner commented Oct 3, 2025

Uh oh!

poiana commented Oct 3, 2025

Uh oh!

poiana commented Oct 3, 2025

Uh oh!

Uh oh!

jvlerner commented Oct 9, 2025

Uh oh!

ekoops left a comment

Uh oh!

ekoops Oct 9, 2025

Uh oh!

ekoops Oct 9, 2025

Uh oh!

ekoops Oct 9, 2025

Uh oh!

ekoops Oct 9, 2025

Uh oh!

ekoops Oct 9, 2025

Uh oh!

leogr commented Oct 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		{{- include "falco.proxyEnv" . \| nindent 2 }}
		{{- include "falco.renderTemplate" ( dict "value" .Values.falcoctl.artifact.follow.env "context" $) \| nindent 4 }}

		\| proxy.http \| string \| `"http://proxy.dominio.com:3128"` \| HTTP proxy URL used for outbound HTTP requests. \|
		\| proxy.https \| string \| `"http://proxy.dominio.com:3128"` \| HTTPS proxy URL used for outbound HTTPS requests. \|

Feat/falco proxy env #918

Are you sure you want to change the base?

Feat/falco proxy env #918

Conversation

jvlerner commented Oct 3, 2025

Uh oh!

poiana commented Oct 3, 2025

Uh oh!

poiana commented Oct 3, 2025

Uh oh!

Uh oh!

jvlerner commented Oct 9, 2025

Uh oh!

ekoops left a comment

Choose a reason for hiding this comment

Uh oh!

ekoops Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

ekoops Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

ekoops Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

ekoops Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

ekoops Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

leogr commented Oct 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants