refactor: export proxy configuration directly

parts/linux/cloud-init/artifacts/cse_cmd.sh

@@ -134,7 +134,6 @@ CUSTOM_SEARCH_DOMAIN_FILEPATH="{{GetCustomSearchDomainsCSEScriptFilepath}}"
 HTTP_PROXY_URLS="{{GetHTTPProxy}}"
 HTTPS_PROXY_URLS="{{GetHTTPSProxy}}"
 NO_PROXY_URLS="{{GetNoProxy}}"
-PROXY_VARS="{{GetProxyVariables}}"
 ENABLE_SECURE_TLS_BOOTSTRAPPING="{{EnableSecureTLSBootstrapping}}"
 SECURE_TLS_BOOTSTRAPPING_AAD_RESOURCE="{{GetSecureTLSBootstrappingAADResource}}"
 SECURE_TLS_BOOTSTRAPPING_USER_ASSIGNED_IDENTITY_ID="{{GetSecureTLSBootstrappingUserAssignedIdentityID}}"

parts/linux/cloud-init/artifacts/cse_main.sh

@@ -46,6 +46,20 @@ source "${CSE_INSTALL_FILEPATH}"
 source "${CSE_DISTRO_INSTALL_FILEPATH}"
 source "${CSE_CONFIG_FILEPATH}"
 
+# configureEtcEnvironment persists these values, but the current CSE process needs them immediately.
+if [ -n "${HTTP_PROXY_URLS}" ]; then
+    export HTTP_PROXY="${HTTP_PROXY_URLS}"
+    export http_proxy="${HTTP_PROXY_URLS}"
+fi
+if [ -n "${HTTPS_PROXY_URLS}" ]; then
+    export HTTPS_PROXY="${HTTPS_PROXY_URLS}"
+    export https_proxy="${HTTPS_PROXY_URLS}"
+fi
+if [ -n "${NO_PROXY_URLS}" ]; then
+    export NO_PROXY="${NO_PROXY_URLS}"
+    export no_proxy="${NO_PROXY_URLS}"
+fi
+
 # Disable a single kernel module with a known LPE vulnerability.
 # Writes a modprobe blacklist rule and unloads the module if loaded.
 # Safe to run repeatedly during VHD build or provisioning; idempotent (overwrites with same content if already present).
@@ -180,13 +194,6 @@ function basePrep {
         systemctl restart systemd-timesyncd
     fi
 
-    # Eval proxy vars to ensure curl commands use proxy if configured.
-    # e.g. PROXY_VARS=`export HTTPS_PROXY="https://proxy.example.com:8080"; export http_proxy="http://proxy.example.com:8080"; export NO_PROXY="127.0.0.1,localhost";`
-    # Setting vars in etc environment (configureEtcEnvironment) won't take effect in current shell session.
-    if [ -n "${PROXY_VARS}" ]; then
-        eval $PROXY_VARS
-    fi
-
     resolve_packages_source_url
     logs_to_events "AKS.CSE.setPackagesBaseURL" "echo $PACKAGE_DOWNLOAD_BASE_URL"
 
@@ -446,9 +453,6 @@ function nodePrep {
     fi
 
     if [ -n "${OUTBOUND_COMMAND}" ]; then
-        if [ -n "${PROXY_VARS}" ]; then
-            eval $PROXY_VARS
-        fi
         retrycmd_if_failure 20 1 15 $OUTBOUND_COMMAND >> /var/log/azure/cluster-provision-cse-output.log 2>&1 || exit $ERR_OUTBOUND_CONN_FAIL;
     fi
     if [ -n "${BOOTSTRAP_PROFILE_CONTAINER_REGISTRY_SERVER}" ]; then

pkg/agent/variables.go

@@ -4,7 +4,6 @@
 package agent
 
 import (
-	"fmt"
 	"strconv"
 	"strings"
 
@@ -230,20 +229,8 @@ func getOutBoundCmd(nbc *datamodel.NodeBootstrappingConfiguration, cloudSpecConf
 	return connectivityCheckCommand
 }
 
-func getProxyVariables(nbc *datamodel.NodeBootstrappingConfiguration) string {
-	// only use https proxy, if user doesn't specify httpsProxy we autofill it with value from httpProxy.
-	proxyVars := ""
-	if nbc.HTTPProxyConfig != nil {
-		if nbc.HTTPProxyConfig.HTTPProxy != nil {
-			// from https://curl.se/docs/manual.html, curl uses http_proxy but uppercase for others?
-			proxyVars = fmt.Sprintf("export http_proxy=\"%s\";", *nbc.HTTPProxyConfig.HTTPProxy)
-		}
-		if nbc.HTTPProxyConfig.HTTPSProxy != nil {
-			proxyVars = fmt.Sprintf("export HTTPS_PROXY=\"%s\"; %s", *nbc.HTTPProxyConfig.HTTPSProxy, proxyVars)
-		}
-		if nbc.HTTPProxyConfig.NoProxy != nil {
-			proxyVars = fmt.Sprintf("export NO_PROXY=\"%s\"; %s", strings.Join(*nbc.HTTPProxyConfig.NoProxy, ","), proxyVars)
-		}
-	}
-	return proxyVars
+// getProxyVariables is retained until GetProxyVariables is removed from the template function map.
+// Proxy variables are exported directly from their URL values in cse_main.sh.
+func getProxyVariables(_ *datamodel.NodeBootstrappingConfiguration) string {
+	return ""
 }