Skip to content

Conversation

@cappyzawa
Copy link
Member

ref: #1144 .

Note: The proxy URL parsing optimization mentioned in #1144 will be addressed in a separate follow-up PR.

Comment on lines +320 to +322
err := errors.New("specifying proxy with 'proxy' key in the referenced secret is deprecated, use spec.proxySecretRef with 'address' key instead. Support for the 'proxy' key is removed in v1")
log.FromContext(ctx).Error(err, "no longer supported.")
return nil, nil, err
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If someone applies a manifest that still includes .spec.proxy, it will likely error because the field has been removed. However, using the deprecated proxy key in a Secret’s data won’t cause that kind of failure.

Given that, I’ve kept the error handling in place. Users will see the issue via kubectl describe, and operators will get a clear message in the logs.

If you think this is overkill or have a simpler approach, I’m all ears.

@cappyzawa cappyzawa force-pushed the remove-deprecated-proxy-fields branch from bc217dc to 59f2038 Compare October 6, 2025 17:46
The spec.proxy field and 'proxy' key in secrets are no longer
supported. These fields were deprecated in v2.7 with the introduction
of spec.proxySecretRef as the recommended approach.

Signed-off-by: cappyzawa <[email protected]>
@cappyzawa cappyzawa force-pushed the remove-deprecated-proxy-fields branch from 59f2038 to 4a82d2c Compare November 12, 2025 15:06
@cappyzawa
Copy link
Member Author

cappyzawa commented Nov 12, 2025

Quick recap (mostly for future me since it's been a while 😅):

Timeline

  1. Oct 6: Opened this PR to remove deprecated proxy fields
  2. Oct 6: Created runtime/secrets: validate proxy URL scheme and length pkg#1038 to add validation (scheme + length check) to ProxyURLFromSecret to prevent regression
  3. Oct 6: runtime/secrets: validate proxy URL scheme and length pkg#1038 merged (runtime/v0.87.0)
  4. Oct 9: Bug report in SOCKS proxy secret is no longer working source-controller#1915 - SOCKS5 proxy broke 💥🙇
  5. Oct 9: Revert "runtime/secrets: validate proxy URL scheme and length" pkg#1041 reverted the validation (runtime/v0.88.0)

Why the revert?
This happened right after Flux v2.7 release. Adding SOCKS5 support would be a feature addition, not suitable for a patch release. So we reverted to fix the regression first.

Next steps
I'll create a new pkg PR with proper validation supporting http/https/socks5, then update this PR to use it.

Note

According to the official documentation, only http/https/socks5 schemes are officially supported for proxy configuration.

@matheuscscp
Copy link
Member

Adding SOCKS5 support would be a feature addition, not suitable for a patch release.

Small correction: Making the validation stricter isn't suitable for a patch release (unless we're fixing a CVE, which was not the case), so we decided to revert the validation PR in fluxcd/pkg altogether. Support for SOCKS5 already existed (removing it was the regression).

@cappyzawa cappyzawa added the hold Issues and pull requests put on hold label Nov 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

hold Issues and pull requests put on hold

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants