Corporate Proxies

How to configure Talos Linux to use proxies in a corporate environment

​

Appending the certificate authority of MITM proxies

See Custom Certificate Authorities to append the CA certificate of your corporate proxy to the trusted store.

​

Configuring a machine to use the proxy

To configure Talos to use an HTTP or HTTPS proxy, set the appropriate environment variables in the machine configuration:

machine:
  env:
    http_proxy: <http proxy>
    https_proxy: <https proxy>
    no_proxy: <no proxy>

In proxy-restricted environments, you may also need to configure DNS (nameservers) and NTP (timeservers) explicitly:

machine:
  env:
  ...
  time:
    servers:
      - <server 1>
      - <server ...>
      - <server n>
  ...
  network:
    nameservers:
      - <ip 1>
      - <ip ...>
      - <ip n>

If proxy access is required before the machine configuration is applied (for example, during initial boot), provide the proxy settings via kernel command line arguments:

talos.environment=http_proxy=<http-proxy> talos.environment=https_proxy=<https-proxy>

DNS and NTP settings can also be managed using their dedicated configuration documents: ResolverConfig and TimeSyncConfig respectively.

​

Connecting to Omni through a proxy

Machines managed by Omni have additional requirements behind a proxy. The SideroLink overlay prefix, 0.0.0.0, and the machines’ own subnets must be listed in no_proxy, and the SideroLink gRPC tunnel must be enabled where outbound UDP is blocked. See Connect Machines to Omni Through a Corporate Proxy.