Guide

February 11, 2025

Helm Forward Proxy External Server: A Complete Guide

Helm has become the standard package manager for Kubernetes, streamlining the deployment and management of applications. However, in environments where network restrictions, firewalls, or security policies limit direct access to external repositories, a Helm forward proxy external server becomes a critical solution.

Using a forward proxy, organizations can ensure secure, stable, and efficient access to Helm charts and external registries while maintaining compliance with network policies. In this guide, we’ll explore the necessity, setup, and best practices for implementing a Helm forward proxy external server, covering everything from proxy configuration to Kubernetes-specific optimizations.

Why Use a Forward Proxy with Helm?

Before diving into the technical details, let’s first understand why organizations need a Helm forward proxy external server:

1. Restricted Network Access

Many enterprises operate within restricted networks where direct access to external repositories, such as GitHub or Artifact Hub, is blocked. A forward proxy enables controlled access by routing traffic through a designated proxy server.

2. Enhanced Security and Compliance

By directing Helm traffic through a forward proxy, organizations can enforce security policies, perform deep packet inspection, and monitor traffic to detect anomalies.

3. Caching and Performance Improvements

A forward proxy can cache Helm charts, reducing redundant requests and improving installation speed by serving pre-fetched resources.

4. Authentication and Logging

Forward proxies can enforce authentication before granting access to Helm repositories, ensuring only authorized users and workloads can pull charts. Additionally, they provide comprehensive logging for monitoring and auditing purposes.

How Helm Communicates with External Repositories

Helm requires external network access to fetch charts from repositories. The key network interactions include:

Fetching Helm charts from remote repositories (helm repo add and helm fetch).
Updating chart repositories (helm repo update).
Downloading and installing charts (helm install).
Interacting with OCI-based registries (helm push and helm pull).

If direct internet access is blocked, Helm will hang indefinitely or return errors such as:

Error: Looks like “https://charts.example.com/” is not a valid chart repository or cannot be reached

A Helm forward proxy external server solves these issues by intercepting and forwarding Helm requests.

Configuring Helm to Use a Forward Proxy

Step 1: Set Up Environment Variables

Helm relies on the standard HTTPS_PROXY, HTTP_PROXY, and NO_PROXY environment variables.

For Linux/macOS:

export HTTPS_PROXY=http://proxy.example.com:8080
export HTTP_PROXY=http://proxy.example.com:8080
export NO_PROXY=localhost,127.0.0.1,.example.com
export HTTPS_PROXY=http://proxy.example.com:8080
export HTTP_PROXY=http://proxy.example.com:8080
export NO_PROXY=localhost,127.0.0.1,.example.com

  

  Copy Code

For Windows (PowerShell):

$env:HTTPS_PROXY=”http://proxy.example.com:8080″
$env:HTTP_PROXY=”http://proxy.example.com:8080″
$env:NO_PROXY=”localhost,127.0.0.1,.example.com”

Verify the settings:

env | grep -i proxy

Step 2: Configure Helm to Use the Proxy

Once the environment variables are set, Helm will automatically route traffic through the proxy.

Test the configuration by adding a Helm repository:

helm repo add stable https://charts.helm.sh/stable
helm repo update

If successful, Helm will pull repository data through the forward proxy.

Setting Up a Forward Proxy for Helm

There are multiple proxy solutions that can act as a Helm forward proxy external server. The most common ones include NGINX, Squid, and Smokescreen (Stripe’s forward proxy).

Option 1: Setting Up an NGINX Forward Proxy

NGINX is a powerful, lightweight HTTP proxy server that can be configured as a forward proxy.

Step 1: Install NGINX

sudo apt update && sudo apt install nginx -y

Step 2: Configure NGINX as a Forward Proxy

Edit the NGINX configuration file:

sudo nano /etc/nginx/nginx.conf

Add the following configuration:

nginx

worker_processes  auto;

events {}

http {
    server {
        listen 8080;
        resolver 8.8.8.8;

        proxy_connect;
        proxy_connect_connect_timeout 10s;
        proxy_connect_data_timeout 10s;

        location / {
            proxy_pass http://$host;
            proxy_set_header Host $host;
        }
    }
}

Save the file and restart NGINX:

sudo systemctl restart nginx

Step 3: Configure Helm to Use the NGINX Proxy

Set the proxy variables:

export HTTPS_PROXY=http://localhost:8080
export HTTP_PROXY=http://localhost:8080

Test the connection:

helm repo update

Option 2: Using Squid as a Forward Proxy

Squid is a popular caching proxy that can efficiently handle Helm requests.

Step 1: Install Squid

sudo apt install squid -y

Step 2: Configure Squid

Edit the Squid configuration file:

sudo nano /etc/squid/squid.conf

Add the following:

http_port 3128
acl allowed_ips src 192.168.1.0/24
http_access allow allowed_ips

Restart Squid:

sudo systemctl restart squid

Step 3: Set Proxy for Helm

export HTTPS_PROXY=http://localhost:3128
export HTTP_PROXY=http://localhost:3128

Test Helm:

helm repo update

Option 3: Using Smokescreen for Static IPs

Smokescreen is Stripe’s forward proxy tool, ideal for webhooks and Helm.

Step 1: Install Smokescreen

git clone https://github.com/stripe/smokescreen.git
cd smokescreen
go build

Step 2: Start Smokescreen

./smokescreen –listen-port 8081

Step 3: Set Proxy Variables

export HTTPS_PROXY=http://localhost:8081

Handling Kubernetes Helm Charts via Proxy

For Helm deployments in Kubernetes, configure the proxy settings inside a Helm values file.

Example values.yaml:

proxy:
  httpProxy: http://proxy.example.com:8080
  httpsProxy: http://proxy.example.com:8080
  noProxy: localhost,127.0.0.1,.example.com

Modify the deployment manifest:

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
        – name: helm-client
          env:
            – name: HTTPS_PROXY
              value: “http://proxy.example.com:8080”
            – name: NO_PROXY
              value: “localhost,127.0.0.1,.example.com”

Apply the changes:

proxy:
kubectl apply -f deployment.yaml

Best Practices for Using a Helm Forward Proxy External Server

Monitor Proxy Logs – Regularly check logs for unusual activity.
Use Authentication – Secure the proxy with credentials to prevent unauthorized access.
Optimize Caching – Reduce redundant Helm chart downloads.
Implement ACLs – Restrict proxy access to trusted clients.
Test Configuration – Always verify proxy settings before deploying to production.

Conclusion

A Helm forward proxy external server is essential for managing Helm repositories in restricted network environments. Whether using NGINX, Squid, or Smokescreen, setting up a proxy ensures secure, efficient, and controlled access to Helm charts. By following best practices, organizations can maximize performance, security, and compliance while seamlessly integrating Helm into their Kubernetes workflows.

FAQs

Can I use a Helm forward proxy external server to access private Helm repositories?

Yes. A forward proxy can be configured to authenticate and pull Helm charts from private repositories that require credentials. This setup helps ensure secure access and controlled distribution of Helm charts within an organization.

What are the best proxy settings for Helm when working behind a corporate firewall?

To enable Helm to function properly behind a corporate firewall, you must configure the proxy settings correctly. This includes defining both HTTP and HTTPS proxy settings while also allowing exceptions for internal traffic. Ensuring that the firewall supports SSL termination can further improve connectivity.

How do I troubleshoot Helm failing to pull charts through a proxy?

If Helm encounters issues when retrieving charts via a forward proxy, the best approach is to verify the proxy settings, check network connectivity, and ensure that DNS resolution is functioning correctly. Additionally, reviewing Helm logs for any error messages can provide insight into the root cause.

Can a forward proxy improve the performance of Helm chart deployments?

Yes. A forward proxy can significantly improve Helm chart deployment speed by caching frequently accessed chart data. This reduces redundant downloads, minimizes external bandwidth usage, and accelerates overall deployment times.

Is it possible to use a Helm forward proxy external server with cloud-based Kubernetes clusters?

Yes. Cloud-based Kubernetes clusters can be configured to route traffic through an external forward proxy. This ensures controlled access to external repositories while enforcing security policies. Some cloud providers also offer built-in proxy solutions that can be integrated with Helm for enhanced control.

Author

Emma

Technical writer, proxy testing expert