How to set no_proxy in Kubernetes pods

Question

Because my Kubernetes Cluster is behind a corporate proxy, I need to set http/https proxy in pods via environment variables and set no_proxy to allow inter-pod and inter-service communication and communication with other local private servers.

Proxy http/https configuration worked perfectly when passing to the pods through env variables; but no_proxy did not work well and it breaks internal pod/service communication.

I have tried unsuccessfully to set no_proxy and NO_PROXY at different levels in Kubernetes, mainly at:

Docker daemon: /etc/systemd/system/docker.service.d/http-proxy.conf
Docker client: /root/.docker/config.json (although it does not seem applicable when using Docker v1.13.1 on CentOS)
Docker client: through environment variables passed to the pods at creation time, in the yaml file used to run them with kubectl
Kubernetes master and worker nodes as environment variables
and many combinations of the above settings

Proxy configuration within PODs succeeded with env variables inside the PODs:

export http_proxy="http://10.16.1.1:8080"
export https_proxy="https://10.16.1.1:8080"

But, none of the above worked for no_proxy exceptions, and I tried many syntax and also added my nodes, pod & service networks, and .svc (as suggested for OpenShift)... as listed below:

export no_proxy=".svc,.example.com"
export no_proxy="localhost,127.0.0.0/8,10.1.16.0/24,10.240.0.0/16,10.241.0.0/16,*.domain.com"
export no_proxy=".svc,.default,.local,.cluster.local,localhost,127.0.0.0/8,10.1.16.0/24,10.240.0.0/16,10.241.0.0/16,.domain.com"
export NO_PROXY=$no_proxy

I am using Kubernetes v1.11.2 + Docker v1.13.1 on CentOS7;
Any help would be appreciated.

Can you please add you pod, service and local network ranges? — aurelius
My network ranges are the below (already tried them in no_proxy): Nodes 10.1.16.0/24, Pods 10.240.0.0/16, and Service 10.241.0.0/16 — geomar
which CNI are you using? there seem to be an issue with setting this up in Calico as specified in this article (which also could be helpful with your issue) — aurelius
I'm using Calico indeed, and it works better than Weave and Flannel. In fact, I couldn't set my Kubernetes cluster with custom pod/service network subnets and use Ingress without Calico. But checking the link you sent, it does not seem to related to Proxy configuration inside pods, but rather talks about Proxy config at the Kubernetes nodes level and for setting up the environment. — geomar

B.Z. B.Z. · Accepted Answer · 2019-09-08T17:14:59

We can make a reasonable assumption that we don't directly use IP address to access external network servers. In other words, we use FQDN to access, say python.com, google.com, github.com, but not directly using their IP addresses.

With this assumption, we can bypass web-proxy for all direct IP address access.

export no_proxy=localhost,.svc
printf -v allip '%s,' .{0..255}
export no_proxy="$no_proxy,${allip%,}"

This adds .0,.1,.2,...,.255 to the no_proxy env variable. There is no magic here. We just treat IP address as FQDN, so a suffix match works as FQDN no_proxy setting. Say, .120 would match all IP addresses x.x.x.122.

How to set no_proxy in Kubernetes pods

3 Answers