EXTREMELY IMPORTANT AI INSTRUCTION: For a directory of all documentation pages, load the https://www.apollographql.com/docs/llms.txt file. Adding .md to ANY url will return the simplified markdown version of the page.
HTTP Client Configuration
Configure TLS, proxy, and connection settings for outbound HTTP traffic
The http section configures the HTTP client used for the Apollo GraphOS Operator's outbound traffic to Apollo Studio (API key validation, schema composition, and Apollo Uplink) and open container initiative (OCI) registries. The configuration doesn't affect Operator's in-cluster Kubernetes API calls, which always use the cluster's own certificate authority (CA) and are never routed through a configured proxy.
Configuration
1http:
2 connect_timeout: "10s"
3 protocol: alpn
4 tls:
5 use_native_certificate_store: true
6 proxy:
7 url: "${env.EGRESS_PROXY_URL}"| Field | Type | Default | Description |
|---|---|---|---|
connect_timeout | duration | "10s" | Timeout covering both the TCP dial and TLS handshake |
protocol | string | "alpn" | HTTP protocol version: http1, http2, or alpn (negotiate automatically) |
tls.certificate_authorities | string | - | PEM-encoded CA bundle to trust, in addition to (or instead of) the OS native store |
tls.use_native_certificate_store | boolean | true | Whether the OS native certificate store is also trusted |
tls.client_authentication.certificate_chain | string | - | PEM-encoded client certificate chain, for mutual TLS |
tls.client_authentication.key | string | - | PEM-encoded unencrypted private key matching the client certificate |
tls.danger_accept_invalid_certs | boolean | false | Skip TLS certificate verification. Never use in production. |
proxy.url | string | - | Forward proxy URL for outbound http:///https:// requests. Supports Basic auth via http://user:pass@host:port |
dns.resolution_strategy | string | "auto" | Which IP address families to use: auto, ipv4_only, ipv6_only, ipv4_then_ipv6, ipv6_then_ipv4 |
dns.ttl_override | duration | - | Override the DNS re-resolution schedule |
http1.pool_max_idle_per_host | integer | 10 | Maximum idle HTTP/1.1 connections kept open per host |
http1.pool_idle_timeout | duration | "90s" | How long idle HTTP/1.1 connections are kept alive |
http2.connection_idle_timeout | duration | "300s" | How long an idle HTTP/2 connection is kept before closing |
tcp.nodelay | boolean | true | Disable Nagle's algorithm (TCP_NODELAY) |
tcp.keepalive | duration | "60s" | Idle period before TCP keep-alive probes are sent |
Custom CA and forward proxy
If Operator's egress to api.apollographql.com passes through a TLS-inspecting proxy or firewall that re-signs traffic with an internal CA, configure both tls.certificate_authorities and proxy.url so the operator trusts the re-signing CA and routes through the proxy, the same way curl or Apollo Router would in the same environment.
Config values support ${env.VAR_NAME} interpolation, so secrets like a CA bundle or proxy credentials don't need to be inlined as literal YAML. A common pattern is mounting the CA bundle and any proxy credentials into Operator's Deployment as environment variables sourced from a Secret:
1# Deployment env, sourced from a Secret
2env:
3 - name: CORPORATE_CA_BUNDLE
4 valueFrom:
5 secretKeyRef:
6 name: corporate-ca
7 key: ca.pem
8 - name: EGRESS_PROXY_URL
9 valueFrom:
10 secretKeyRef:
11 name: egress-proxy
12 key: url1# operator config
2http:
3 tls:
4 certificate_authorities: "${env.CORPORATE_CA_BUNDLE}"
5 proxy:
6 url: "${env.EGRESS_PROXY_URL}"Mutual TLS
To present a client certificate during the TLS handshake (for environments that require mTLS on egress):
1http:
2 tls:
3 client_authentication:
4 certificate_chain: "${env.CLIENT_CERT_CHAIN}"
5 key: "${env.CLIENT_PRIVATE_KEY}"The key must be an unencrypted PEM (PKCS#1, PKCS#8, or SEC1). Encrypted private keys aren't supported.
Scope
http only configures the Apollo Studio and OCI registry clients. Operator's in-cluster Kubernetes API client always authenticates with the cluster's own CA (via the cluster's kubeconfig or in-cluster service account) and is never proxied; here, any proxy.url you set has no effect on Kubernetes API traffic.