Automate proxy injection for Amazon EKS on AWS Fargate using Kyverno

This article demonstrates how to use Kyverno mutating admission policies to automatically inject corporate proxy environment variables into Amazon EKS on AWS Fargate pods without modifying application manifests.

• AWS Fargate doesn't expose node-level configuration, requiring pod-level proxy injection for regulated environments routing traffic through corporate proxies
• Kyverno MutatingPolicy injects HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables into containers at admission time
• Namespace label selectors enable opt-in targeting, allowing safe deployment in mixed Fargate and EC2 clusters
• Solution replaces per-workload proxy configuration with a single ~30-line YAML policy applied cluster-wide
• Fluent Bit log router bypasses proxy via NO_PROXY entries, ensuring logs reach AWS CloudWatch directly
• Init containers and sidecar containers receive proxy variables through separate mutations in the policy

This approach eliminates manual proxy configuration from deployment manifests while maintaining centralized, GitOps-compatible policy management across labeled namespaces.