I work on the OpenStack deployment for a hedge fund where all internet access goes through a proxy. (We have the same concern about public cloud although we're slowly figuring it out.) The initial deployment predated me, but there's nothing in our config that does anything special with OpenStack and internet access, and it works. We also have a Kubernetes deployment that also (AFAIK) just works. We're not able to `docker pull` very easily because of the proxy, but if we generate our own images they work fine.
What is trying to connect to the public internet?
(If you mean that they expect a direct connection between client machines and servers, then, yes, they probably do and that's not a scenario I've run into personally.)
The Openstack deployments first failed while trying to download different pieces of sotware. As each part/script seems to use a different tool to download or get packages, we had to chase each one to find where the proxies should be configured.
Once the cluster started, again, you have to find which tool is trying to use the proxy and now can't connect with the rest of the cluster. Sorry I can't be more specific, I gave up with this some months ago. I don't think we have the scale for Openstack.
Same problems, maybe in different steps, occurred with the other tools.
To solve the `docker pull` problem, we are trying with Nexus to proxy the global registry. But given that some of the scripting/tools that deploy kubernetes do some magic starting things that we can't directly control, we can't configure docker to pull from a proxy (not that we have found how to tell the stupid thing how to avoid going to the global registry and only use our proxy/registry). Once again, when we finally managed to pull those images, we have to guess how to unconfigure proxies to be able to fully connect the cluster.
The connection between clients and servers is another concern we haven't yet got to, but we can see it won't be a simple solution.
(Oh, I don't particularly recommend OpenStack unless you know you're a fit for its scale and also the specific things it's good at, yes.)
I would expect some installer shell script not to work well, yes. If you can mirror repositories internally (or configure apt/yum/whatever to work with the proxy), that should be fine... we've deployed one OpenStack instance using (more or less) pip and one using Debian packages.
Nothing in our running infrastructure attempts to connect to the external internet.
What is trying to connect to the public internet?
(If you mean that they expect a direct connection between client machines and servers, then, yes, they probably do and that's not a scenario I've run into personally.)