Add proxy support to GPU validation role

gpu-validation/defaults/main.yaml

@@ -50,9 +50,19 @@ gpu_validation_security_group: basic
 gpu_validation_floating_ip: 192.168.122.222
 # [string] WARNING Where to (over-)write the ssh key. Must match path in inventory
 gpu_validation_private_key_file: ~/test_keypair.key
+
 # [string] SSH ProxyCommand for accessing VMs through a bastion/hypervisor
 # Example: '-o ProxyCommand="ssh -W %h:%p -o StrictHostKeyChecking=no -i /path/to/key user@bastion-host"'
 gpu_validation_ssh_proxy_command:
+# [string] HTTP proxy for outbound connections (dnf, container pulls, model downloads)
+# Do not embed credentials in the URL — proxy values are written to systemd unit files
+# Example: 'http://proxy.example.com:3128'
+gpu_validation_http_proxy: ''
+# [string] HTTPS proxy for outbound connections
+gpu_validation_https_proxy: ''
+# [string] Comma-separated list of hosts/domains to bypass proxy
+gpu_validation_no_proxy: "localhost,127.0.0.1"
+
 # [bool] Whether to clean up the VM before running tests
 gpu_validation_pre_cleanup_enabled: true
 # [bool] Whether to clean up the VM after running tests

gpu-validation/tasks/model_download_and_serve.yaml

@@ -58,6 +58,8 @@
 - name: Wait for vllm API to appear
   ansible.builtin.uri:
     url: "{{ gpu_validation_vllm_api_url }}/health"
+    use_proxy: false
+    validate_certs: false
   register: api_result
   until: ("status" in api_result) and (api_result.status == 200)
   retries: 180  # 180 * 10 = 30 mins - this includes the time to download the model
@@ -67,6 +69,8 @@
 - name: Wait for vllm metrics endpoint to appear
   ansible.builtin.uri:
     url: "{{ gpu_validation_vllm_api_url }}/metrics/"
+    use_proxy: false
+    validate_certs: false
   register: metrics_result
   until: ("status" in metrics_result) and (metrics_result.status == 200)
   retries: 12  # 12 * 10 = 2 mins after API appears

gpu-validation/tasks/proxy.yaml

@@ -0,0 +1,41 @@
+---
+- name: Configure HTTP/HTTPS proxy for outbound connections
+  ansible.builtin.blockinfile:
+    path: /etc/environment
+    create: true
+    mode: "0644"
+    block: |
+      HTTP_PROXY={{ gpu_validation_http_proxy }}
+      HTTPS_PROXY={{ gpu_validation_https_proxy | default(gpu_validation_http_proxy, true) }}
+      http_proxy={{ gpu_validation_http_proxy }}
+      https_proxy={{ gpu_validation_https_proxy | default(gpu_validation_http_proxy, true) }}
+      NO_PROXY={{ gpu_validation_no_proxy }}
+      no_proxy={{ gpu_validation_no_proxy }}
+
+- name: Configure dnf proxy
+  ansible.builtin.lineinfile:
+    path: /etc/dnf/dnf.conf
+    regexp: '^proxy='
+    line: "proxy={{ gpu_validation_http_proxy }}"
+
+- name: Configure container engine proxy
+  ansible.builtin.file:
+    path: /etc/systemd/system/podman.service.d
+    state: directory
+    mode: "0755"
+
+- name: Set container engine proxy environment
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/podman.service.d/http-proxy.conf
+    mode: "0644"
+    content: |
+      [Service]
+      Environment="HTTP_PROXY={{ gpu_validation_http_proxy }}"
+      Environment="HTTPS_PROXY={{ gpu_validation_https_proxy | default(gpu_validation_http_proxy, true) }}"
+      Environment="NO_PROXY={{ gpu_validation_no_proxy }}"
+  register: _proxy_dropin
+
+- name: Reload systemd daemon
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+  when: _proxy_dropin.changed  # noqa: no-handler - must reload before subsequent tasks use podman

gpu-validation/tasks/setup.yaml

@@ -6,6 +6,10 @@
   when: gpu_validation_dns_server != ""
   changed_when: true
 
+- name: Configure proxy settings
+  ansible.builtin.include_tasks: proxy.yaml
+  when: gpu_validation_http_proxy | length > 0
+
 - name: Install needed driver dependency packages for RHEL
   when:
     - ansible_distribution == "RedHat"

gpu-validation/templates/vllm-serve.service.j2

@@ -5,6 +5,11 @@ Description=vllm model serve service
 WantedBy=multi-user.target default.target
 
 [Service]
+{% if gpu_validation_http_proxy | length > 0 %}
+Environment="HTTP_PROXY={{ gpu_validation_http_proxy }}"
+Environment="HTTPS_PROXY={{ gpu_validation_https_proxy | default(gpu_validation_http_proxy, true) }}"
+Environment="NO_PROXY={{ gpu_validation_no_proxy | default('localhost,127.0.0.1') }}"
+{% endif %}
 ExecStart=podman run \
     {{ gpu_validation_workload_device_opts }} \
     {{ gpu_validation_workload_security_opts }} \
@@ -14,6 +19,11 @@ ExecStart=podman run \
     -v {{ gpu_validation_workload_cache_dir }}:{{ gpu_validation_workload_cache_mount_path }}:Z \
 {% if gpu_validation_model_download_hf_token %}
     --env "HUGGING_FACE_HUB_TOKEN={{ gpu_validation_model_download_hf_token | quote }}" \
+{% endif %}
+{% if gpu_validation_http_proxy | length > 0 %}
+    --env "HTTP_PROXY={{ gpu_validation_http_proxy }}" \
+    --env "HTTPS_PROXY={{ gpu_validation_https_proxy | default(gpu_validation_http_proxy, true) }}" \
+    --env "NO_PROXY={{ gpu_validation_no_proxy | default('localhost,127.0.0.1') }}" \
 {% endif %}
     {{ gpu_validation_workload_additional_env }} \
     -p 8000:8000 \