---
title: "Configure an outbound HTTP proxy"
description: "Route outbound Calico Enterprise container traffic through an HTTP proxy by configuring the Installation custom resource managed by the Tigera Operator."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Compliance and security"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/compliance/configure-http-proxy"
---

# Configure an outbound HTTP proxy

Calico Enterprise supports the use of HTTP proxies for connections that leave the cluster and originate from Calico Enterprise containers.

`HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables can be set on Calico Enterprise containers by using a mutating admission webhook, or by configuration through the Installation CR if preferred. In the latter case, the Tigera Operator will be responsible for setting proxy environment variables on Calico Enterprise containers that egress out of the cluster.

With either environment variable configuration method, the Tigera Operator will detect the proxy environment variables that are set on Calico Enterprise containers that egress out of the cluster and ensure that network policy in the calico-system tier allows these connections.

This page will outline how to configure an HTTP proxy using the Installation CR.

> **WARNING:** Calico Enterprise assumes that you have exempted in-cluster destinations (including the Kubernetes API server) from proxying via the `NO_PROXY` variable.

## Configuration via Helm

If you wish to manually configure Calico Enterprise via Helm to set proxy environment variables on Calico Enterprise containers (rather than using a mutating admission webhook), you must [customize the values.yaml](https://docs.tigera.io/calico-enterprise/latest/getting-started/install-on-clusters/kubernetes/helm.md#prepare-the-installation-configuration) of the Calico Enterprise Helm chart.

You’ll need to set the proxy configuration in the values.yaml using the `installation.proxy` path, e.g.:

```yaml
installation:
  enabled: true
  proxy:
    httpProxy:  <HTTP proxy value>
    httpsProxy: <HTTPS proxy value>
    noProxy:    <No proxy value>
```

## Configuration via Manifest

If you wish to manually configure Calico Enterprise via manifests to set proxy environment variables on Calico Enterprise containers (rather than using a mutating admission webhook), you’ll need to edit the installation manifests provided by Tigera.

Specifically, if you are installing Calico Enterprise, you’ll need to edit the custom-resources.yaml. The Installation CR should be updated to set the `spec.proxy` field, e.g.

```yaml
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  variant: CalicoEnterprise
  imagePullSecrets:
    - name: tigera-pull-secret
  proxy:
    httpProxy:  <HTTP proxy value>
    httpsProxy: <HTTPS proxy value>
    noProxy:    <No proxy value>
```

If you have already installed Calico Enterprise, then you can patch your previously applied Installation CR for the new proxy settings.