Add CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY flag

Proxy-only egress

Set CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1 in the gateway's environment, next to HTTPS_PROXY, when the pod reaches other hosts only through that forward proxy and can't resolve public DNS names itself, or when the proxy refuses CONNECT to an IP address. Requires v2.1.277 or later. It's an environment variable rather than a gateway.yaml key so that nothing in the config file can relax the gateway's address check.

export HTTPS_PROXY=http://proxy.corp.example.com:3128
export NO_PROXY=
export no_proxy=
export CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1

The gateway logs one network: line at boot while proxy-only egress is active.

Each row below is one class of outbound request on a gateway with HTTPS_PROXY set, by default and while proxy-only egress is active.

Outbound request	Default	Proxy-only egress active
provider: anthropic upstreams, Workload Identity Federation token exchange, telemetry.forward_to exports	Resolved and checked locally, then CONNECT to the checked IP address through the proxy. A telemetry collector listed in NO_PROXY is reached directly instead	Hostname handed to the proxy
IdP discovery, JWKS, token, and userinfo	Direct unless oidc.use_proxy: true, then CONNECT to the checked IP address	Hostname handed to the proxy, unless oidc.use_proxy: false keeps an internal IdP direct
Amazon Bedrock, Claude Platform on AWS, Google Cloud's Agent Platform, and Microsoft Foundry upstreams; Google group lookups	Hostname handed to the proxy	Unchanged

Proxy-only egress stays off unless the gateway's environment meets all three of these conditions:

• HTTPS_PROXY or HTTP_PROXY is set.
• NO_PROXY and no_proxy are empty. If your platform injects either into pods, set both to an empty value on the gateway container. Listing a telemetry collector in NO_PROXY keeps proxy-only egress off.
• CLAUDE_GATEWAY_ALLOW_LOOPBACK isn't turned on. A collector or IdP on the pod's own loopback can't be combined with proxy-only egress, because a loopback address handed to the proxy would be the proxy host's own, so give those services an address the proxy can reach instead. For the same reason the gateway refuses localhost-style names outright while proxy-only egress is active.

When one of those conditions isn't met, the gateway logs a warning at boot naming the variable that stopped it and keeps the default behavior.

Once proxy-only egress is active, allow every destination in the proxy, including an internal collector and any host configured by IP address. You can still keep an internal IdP direct with oidc.use_proxy: false.

Turn this on only when the proxy's allowlist is at least as strict as the gateway's own check. The proxy must refuse cloud metadata endpoints such as 169.254.169.254 and metadata.google.internal, link-local addresses, and the proxy host's own loopback, and it must refuse them by the address a name resolves to, not only by name, because the gateway no longer catches a hostname that resolves to one of them. A proxy that connects anywhere it's asked removes the gateway's SSRF guard for these requests.