Configuration

Environment Variables

Multiple namespaces

One Smart Proxy can manage the Ingresses, Routes and Deployments of many namespaces. Choose one of these Helm settings:

config:
  # Only these namespaces (a Role is created in each):
  watchNamespaces: [team-a, team-b, previews]

  # Every namespace (ClusterRole):
  allNamespaces: true

  # Every namespace carrying a label (ClusterRole). New namespaces are picked up as soon as
  # they are labelled, without reinstalling:
  namespaceSelector: smart-proxy=enabled

kubectl label namespace pr-1234 smart-proxy=enabled

Smart Proxy keeps a local cache of the managed namespaces (Deployments, Services, Ingresses, Routes and HPAs), so proxied requests never wait on the Kubernetes API. Patching, waking and sleeping happen only inside managed namespaces; the API refuses anything else.

An Ingress or Route can only send traffic to a Service of its own namespace. Where Smart Proxy patches one outside its own namespace, it creates a stand-in: a Service with Smart Proxy's name and no selector, whose endpoints are Smart Proxy's ready pods, kept up to date as they come and go, and removed when nothing there is patched anymore (or on uninstall). On OpenShift, Endpoints listing pod IPs need the endpoints/restricted permission: the chart grants it (installing the chart then needs cluster-admin, as granting a permission requires holding it).

NetworkPolicies. Two paths must be open:

• Ingress controller → Smart Proxy. The controller sends traffic straight to Smart Proxy's pods, so Smart Proxy's namespace must accept it: on OpenShift, from namespaces labelled policy-group.network.openshift.io/ingress: "" (and policy-group.network.openshift.io/host-network: "" when the router uses host networking); elsewhere, from your ingress controller's namespace.
• Smart Proxy → applications. Requests reach the applications from Smart Proxy's pods. Namespaces whose policies only allow their own namespace and the router (a common OpenShift baseline) must also allow Smart Proxy's namespace, or patched applications time out.

When a namespace stops being managed (removed from watchNamespaces, or its label removed), Smart Proxy restores it: its patched Ingresses/Routes point at the applications again and the workloads it put to sleep are woken. Its routes stay in the dashboard as Unwatched and are patched again if the namespace comes back. This needs Smart Proxy's permissions in that namespace, which namespaceSelector and allNamespaces keep; with watchNamespaces, the chart removes the Role together with the namespace, so delete its routes first.

Metrics

Prometheus metrics are served on a separate port (METRICS_ADDR, default :9090, path /metrics), never through the proxy or behind the dashboard login. The chart exposes it on the Service and can create a ServiceMonitor (metrics.serviceMonitor.enabled).

The dashboard's Report tab shows uptime and replica-hours saved per workload without Prometheus (see Uptime).

Every replica reports the cluster-wide gauges; use max over replicas for them, and sum for the counters. Useful queries:

# Replica-hours saved over the last 7 days
sum(sum_over_time((max by (namespace) (smart_proxy_sleeping_replicas))[7d:1m])) / 60

# 95th percentile cold start per deployment
histogram_quantile(0.95, sum by (le, namespace, deployment) (rate(smart_proxy_wake_duration_seconds_bucket[1h])))

Reserved paths

Smart Proxy answers these paths itself on the proxy port, for every host:

Languages

The dashboard, the "waking up" page and the sign-in page of protected routes are in English or Italian, following the browser's preferred language (Accept-Language); the dashboard can be switched from its header, and remembers the choice. Other languages fall back to English.

Annotations

Smart Proxy uses annotations on Ingress/Route objects to store state and configuration.

Helm Values

See the charts/smart-proxy/values.yaml file for a complete list of Helm configuration options.