CODEWITHSUNDEEP
kuberneteshttp-proxy
Saurav Pathak
Saurav Pathak

Reputation: 836

How can I disable / ignore proxy settings from inside a kubernetes pod only for requests directed to kubernetes services?

I have set these environment variables inside my pod named main_pod.

$ env
HTTP_PROXY=http://myproxy.com
http_proxy=http://myproxy.com

I also have another dynamic pod in pattern sub_pod-{number} which has a service attached to it called sub_pod-{number}.

So, if I add NO_PROXY=sub_pod-1 environment variable in main_pod, request with URL http://sub_pod-1:5000/health_check will run successfully as it won't be directed through proxy which is fine.

But I want this process to be dynamic. sub_pod_45 might spawn at runtime and sub_pod-1 might get destroyed. Is there any better way to handle this rather than updating NO_PROXY for every pod creation / destruction ?

Is there any resource / network policy / egress rule from which I can tell pod that if domain name belongs to kubernetes service, do not route it through proxy server?

Or can I simply use regex or glob patterns in NO_PROXY env variable like NO_PROXY=sub_pod-* ?

Edited

Result of nslookup

root@tmp-shell:/# nslookup sub_pod-1
Server:     10.43.0.10
Address:    10.43.0.10#53

Name:   sub_pod-1.default.svc.cluster.local
Address: 10.43.22.139

When no_proxy=cluster.local,

Proxy bypassed when requested with FQDN

res = requests.get('http://sub_pod-1.default.svc.cluster.local:5000')

Proxy didn't bypass when requested with service name only

res = requests.get('http://sub_pod-1:5000') # I want this to work

I would not want to ask my developers to change the application to use FQDN.

Is there any way cluster can identify if URL resolves to a service present within the network and if it happens do not route the request to proxy ?

Upvotes: 0

Views: 2045

Answers (1)

David Maze
David Maze

Reputation: 159091

Libraries that support the http_proxy environment variable generally also support a matching no_proxy that names things that shouldn't be proxied. The exact syntax seems to vary across languages and libraries but it does seem to be universal that setting no_proxy=example.com causes anything.example.com to not be proxied either.

This is relevant because the Kubernetes DNS system creates its names in a domain based on the cluster name, by default cluster.local. The canonical form of a Service DNS name, for example, is service-name.namespace-name.svc.cluster.local., where service-name and namespace-name are the names of the corresponding Kubernetes objects.

I suspect this means it would work to do two things:

  1. Set an environment variable no_proxy=cluster.local; and
  2. Make sure to use the FQDN form when calling other services, service.namespace.svc.cluster.local.

Pods have similar naming, but are in a pod.cluster.local subdomain. The cluster.local value is configurable at a cluster level and it may be different in your environment.

Upvotes: 3

Related Questions