juju status uses the proxy defined in https_proxy

[Junien F]

Hi,

Running the following :
$ https_proxy=http://foo.bar:3128/ juju status

will make juju try to connect to its controller via the proxy.

I don't see a reason for why juju would use https_proxy. I think it goes against the principle of least surprise.

_If_ for some reason we want to keep this behaviour, please log something related to the proxy in "juju status --debug". All I see is the following :

$ juju status --debug
13:43:36 INFO juju.cmd supercommand.go:56 running juju [2.3.3 gc go1.8]
13:43:36 DEBUG juju.cmd supercommand.go:57 args: []string{"juju", "status", "--debug"}
13:43:36 INFO juju.juju api.go:67 connecting to API addresses: [<controller IP>:17070]

No mention of the proxy there.

Also, if juju needs to timeout after a sane amount of time (10s by default ?). The error logged should be explicit about the proxy.

Thanks

[John A Meinel (jameinel)]

Juju is connecting to an HTTPS endpoint, albeit on a non-standard port. But
it should use a Proxy if you need a proxy to connect to remote machines.

As far as being clearer that we're using a proxy, sure. But I do think we
should be using it if it is set.

On Thu, Feb 15, 2018 at 5:45 PM, Junien Fridrick <<email address hidden>
> wrote:

> Public bug reported:
>
> Hi,
>
> Running the following :
> $ https_proxy=http://foo.bar:3128/ juju status
>
> will make juju try to connect to its controller via the proxy.
>
> I don't see a reason for why juju would use https_proxy. I think it goes
> against the principle of least surprise.
>
> _If_ for some reason we want to keep this behaviour, please log
> something related to the proxy in "juju status --debug". All I see is
> the following :
>
> $ juju status --debug
> 13:43:36 INFO juju.cmd supercommand.go:56 running juju [2.3.3 gc go1.8]
> 13:43:36 DEBUG juju.cmd supercommand.go:57 args: []string{"juju",
> "status", "--debug"}
> 13:43:36 INFO juju.juju api.go:67 connecting to API addresses:
> [<controller IP>:17070]
>
> No mention of the proxy there.
>
> Also, if juju needs to timeout after a sane amount of time (10s by
> default ?). The error logged should be explicit about the proxy.
>
> Thanks
>
> ** Affects: juju
> Importance: Undecided
> Status: New
>
> --
> You received this bug notification because you are subscribed to juju.
> Matching subscriptions: juju bugs
> https://bugs.launchpad.net/bugs/1749710
>
> Title:
> juju status uses the proxy defined in https_proxy
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/juju/+bug/1749710/+subscriptions
>

[Dmitrii Shcherbakov (dmitriis)]

As a user, I don't consider this a Juju bug.

Your controller may not be on the same network as your client and you may be running a client behind a corporate firewall in virtually any location.

Juju client, as many other applications out there depends on a runtime (golang in this case). This runtime may have code that interprets environment variables without the actual application code even knowing it if a default http client is created. I think it's a fairly widely used and expected behavior.

Juju client handling:
https://github.com/juju/juju/blob/juju-2.3.3/cmd/juju/commands/main.go#L176-L186
https://github.com/juju/utils/blob/master/proxy/proxy.go#L33-L49
https://github.com/juju/juju/blob/juju-2.3.3/utils/proxy/proxyconfig.go#L124-L135

DefaultTransport in golang
https://github.com/golang/go/blob/release-branch.go1.9/src/net/http/transport.go#L568-L601
https://github.com/golang/go/blob/release-branch.go1.9/src/net/http/transport.go#L35-L51

I'd leave it as is functionally, with maybe logging the fact that proxy variables were detected as you suggest.

[Junien F (axino)]

> I think it's a fairly widely used and expected behavior.

It is for anything that deals with an HTTP server. I'm a fairly intensive juju user and certainly did not expect "juju status" to use https_proxy.

> Your controller may not be on the same network as your client and you may be running a client behind a corporate firewall in virtually any location.

Likewise, you may have to use an HTTP proxy to access the internet, but you just want to test juju locally and it fails.

Like I said, I guess it's fine if you at least inform the user.

[Tim Penhey (thumper)]

I think it would be sufficient to add some logging saying the proxy it is using if one is set. Sound ok Junien?

[Junien F (axino)]

Sure

[Loïc Gomez (kotodama)]

Stumbled on this too, logging that juju is using the proxy could help indeed.

Thank you!

[Canonical Juju QA Bot (juju-qa-bot)]

This Medium-priority bug has not been updated in 60 days, so we're marking it Low importance. If you believe this is incorrect, please update the importance.