Kubernetes Minikube not starting behind corporate proxy (Windows)

4
votes

I am trying to start minikube behind a corporate proxy on Windows machine. I am using the following start command

minikube start --alsologtostderr --vm-driver="hyperv" --docker-env http_proxy=http://proxyabc.uk.sample.com:3128 --docker-env https_proxy=http://proxyabc.uk.sample.com:3128 --docker-env "NO_PROXY=localhost,127.0.0.1,192.168.211.157:8443"

minikube version = 0.28.0

kubectl version = 1.9.2

I've also tried setting the no proxy variable before the command

set NO_PROXY="$NO_PROXY,192.168.211.158/8443"

But everytime I run the "minikube start" command I end up with the following message

Error starting cluster: timed out waiting to unmark master: getting node minikube: Get https://192.168.211.155:8443/api/v1/nodes/minikube: Forbidden

I have already tried solutions at

https://github.com/kubernetes/minikube/issues/2706 https://github.com/kubernetes/minikube/issues/2363

2
proxykubernetesfirewallminikubecorporate
I get the following detailed error if I run the minikube start with logs enabled error getting Pods with label selector "k8s-app=kube-proxy" [Get 192.168.211.139:8443/api/v1/namespaces/kube-system/…: proxyconnect tcp: dial tcp: lookup "http: no such host] - Asif

2 Answers

2
votes

set NO_PROXY="$NO_PROXY,192.168.211.158/8443"

That slash is not the port, it's the CIDR which defines how many IPs should be excluded from the proxy. Separately, it appears you somehow included the colon in the one provided to --docker-env, which I think is also wrong.

And, the $NO_PROXY, syntax in your set command is also incorrect, since that's the unix-y way of referencing environment variables -- you would want set NO_PROXY="%NO_PROXY%,... just be careful since unless you already have a variable named NO_PROXY, that set will expand to read set NO_PROXY=",192.168.etcetc" which I'm not sure is legal syntax for that variable.

0
votes

I had issues on my work Mac, but the principles are similar. The documentation is easy enough to follow to get MiniKube to point to the corporate proxy, but it expects you to be an authenticated user. In my case, I run tinyproxy on my local machine which listens on port 8888 and then sends anything destined for the outside world via cntlm on port 3128. For this to work, MiniKube has to talk to my mac (its host) which is achieved with the 10.0.2.2 address like so: --docker-env HTTP_PROXY=http://10.0.2.2:8888 --docker-env HTTPS_PROXY=http://10.0.2.2:8888 I also had issues with "x509: certificate signed by unknown authority" on the docker pull commands within minikube, which I solved with the --insecure-registry argument. My entire minikube startup command looks like this, which [finally] works for me:

minikube start --docker-env HTTP_PROXY=http://10.0.2.2:8888 --docker-env HTTPS_PROXY=http://10.0.2.2:8888 --docker-env NO_PROXY=10.0.2.2,192.168.99.100 --insecure-registry="k8s.gcr.io"