Proxy

Configure Automation Suite cluster and input.json for proxy deployment with allowlisted domains and connectors.

To deploy Automation Suite in a proxy configuration, you must configure your cluster and add all UiPath® required domains to an allowlist in your network proxy.

A proxy configuration is required only if you perform an online installation.

Configuring the cluster

For details on how to configure the cluster worker nodes in proxy mode, refer to the OpenShift documentation.

When configuring the cluster nodes in proxy mode, make sure to add the following domains to the no_proxy list:

"<cluster-fqdn>,.<cluster-fqdn>,172.30.0.1,localhost,127.0.0.1,10.0.0.0/8,mcr.microsoft.com,kubernetes,kubernetes.default,kubernetes.default.svc,kubernetes.default.svc.cluster,kubernetes.default.svc.cluster.local,.svc,.svc.cluster,.svc.cluster.local,.svc.cluster.local.,istiod-basic.istio-system.svc,argocd-repo-server,.local,.cluster,ai-helper-svc,ai-pkgmanager-svc,ai-deployer-svc,ai-appmanager-svc,ai-trainer-svc,get,aievents,aimetering,aistorage,identity-service-api"

Note:

Make sure to replace <cluster-fqdn> with the actual FQDN URL.

If you enable Maestro or Temporal as a Service (TaaS), the no_proxy list must also include the CIDR ranges that pods get IP addresses from and the node subnet CIDR ranges. TaaS services connect to each other by pod IP address, and the proxy rejects connections to pod IP addresses that no_proxy does not cover. For example, add the networking.clusterNetwork[].cidr ranges when they fall outside 10.0.0.0/8.

Providing proxy setting in input.json

Configure the input.json file with the following parameters:

Mandatory parameters	Description
enabled	Use true or false to enable or disable proxy settings.
http_proxy	Used to route HTTP outbound requests from the cluster. This should be the proxy server FQDN and port.
https_proxy	Used to route HTTPS outbound requests from the cluster. This should be the proxy server FQDN and port.
no_proxy	Comma-separated list of hosts, IP addresses, or IP ranges in CIDR format that you do not want to route via the proxy server. The list must be the one provided in the Configuring the cluster section of this chapter.

Example input.json for proxy configuration:

"proxy": {
  "enabled": true,
  "http_proxy": "http://<PROXY-SERVER-IP:<PROXY-PORT>",>
  "https_proxy": "http://<PROXY-SERVER-IP:<PROXY-PORT>",>
  "no_proxy": <"paste list from Configuring the cluster section">
  }

Note:

Changes to proxy.no_proxy in input.json take effect only after you run uipathctl manifest apply again.

Adding URLs to an allowlist

You must add the following URLs to the allowlist:

quay.io
*.quay.io
registry.redhat.io
nvcr.io
registry.connect.redhat.com
.microsoft.com
login.microsoftonline.com
login.windows.net
graph.microsoft.com
sfbrprddeploywe.azurecr.io
sfbrprddeploywe.westeurope.data.azurecr.io
registry-data.uipath.com
registry.uipath.com
dc.services.visualstudio.com
activate.uipath.com
download.uipath.com
du-metering.uipath.com
du.uipath.com
du-au.uipath.com
du-ca.uipath.com
du-jp.uipath.com
du-us.uipath.com
du-sg.uipath.com
raw.githubusercontent.com
objects.githubusercontent.com
pkg-containers.githubusercontent.com
raw.github.com
api.github.com
api.nuget.org
pkgs.dev.azure.com
gallery.uipath.com
github.com
pypi.org
pypi.python.org
pythonhosted.org
files.pythonhosted.org
opensuse.org
copr.fedorainfracloud.org
download.copr.fedorainfracloud.org
ping.looker.com
rt.services.visualstudio.com
uipath.pkgs.visualstudio.com
pkgs.uipath.com
.blob.core.windows.net
pkgs.dev.azure.com
in.applicationinsights.azure.com
.pkg.dev
production.cloudflare.docker.com
.googleapis.com
.openai.azure.com
.cognitiveservices.azure.com
api.openai.com
.amazonaws.com
.googleapis.com

Connector domains for Integration Service

To create a connection to Integration Service connectors and allow data traffic from your cluster to connector domains, you must configure an allowlist for connector domains. Refer to Configuring an allowlist for connector domains for the full list of URLs.