英文:
How can I disable / ignore proxy settings from inside a kubernetes pod only for requests directed to kubernetes services?
问题
我在名为main_pod的容器中设置了这些环境变量。
$ env
HTTP_PROXY=http://myproxy.com
http_proxy=http://myproxy.com
我还有另一个动态的容器,它的名称遵循模式sub_pod-{number},并附加了一个名为sub_pod-{number}
的服务。
因此,如果我在main_pod中添加NO_PROXY=sub_pod-1
环境变量,那么使用URL http://sub_pod-1:5000/health_check
的请求将成功运行,因为它不会通过代理进行转发,这是可以接受的。
但我希望这个过程是动态的。在运行时可能会生成sub_pod-45
,而sub_pod-1
可能会被销毁。是否有更好的方法来处理这个问题,而不是每次创建/销毁容器时都更新NO_PROXY
?
是否有资源/网络策略/出口规则,可以告诉容器,如果域名属于Kubernetes服务,就不要将其路由到代理服务器?
或者我可以在NO_PROXY
环境变量中简单地使用正则表达式或通配符模式,比如NO_PROXY=sub_pod-*
?
编辑
nslookup的结果
root@tmp-shell:/# nslookup sub_pod-1
Server: 10.43.0.10
Address: 10.43.0.10#53
Name: sub_pod-1.default.svc.cluster.local
Address: 10.43.22.139
当no_proxy=cluster.local
时,
请求完全限定域名时绕过代理
res = requests.get('http://sub_pod-1.default.svc.cluster.local:5000')
只使用服务名称请求时不绕过代理
res = requests.get('http://sub_pod-1:5000') # 我希望这个能工作
我不希望要求我的开发人员更改应用程序以使用完全限定域名。
是否有办法让集群识别URL是否解析为网络中存在的服务,如果是这样,就不要将请求路由到代理?
英文:
I have set these environment variables inside my pod named main_pod.
$ env
HTTP_PROXY=http://myproxy.com
http_proxy=http://myproxy.com
I also have another dynamic pod in pattern sub_pod-{number} which has a service attached to it called sub_pod-{number}
.
So, if I add NO_PROXY=sub_pod-1
environment variable in main_pod, request with URL http://sub_pod-1:5000/health_check
will run successfully as it won't be directed through proxy which is fine.
But I want this process to be dynamic. sub_pod_45
might spawn at runtime and sub_pod-1
might get destroyed. Is there any better way to handle this rather than updating NO_PROXY
for every pod creation / destruction ?
Is there any resource / network policy / egress rule from which I can tell pod that if domain name belongs to kubernetes service, do not route it through proxy server?
Or can I simply use regex or glob patterns in NO_PROXY
env variable like NO_PROXY=sub_pod-*
?
Edited
Result of nslookup
root@tmp-shell:/# nslookup sub_pod-1
Server: 10.43.0.10
Address: 10.43.0.10#53
Name: sub_pod-1.default.svc.cluster.local
Address: 10.43.22.139
When no_proxy=cluster.local
,
Proxy bypassed when requested with FQDN
res = requests.get('http://sub_pod-1.default.svc.cluster.local:5000')
Proxy didn't bypass when requested with service name only
res = requests.get('http://sub_pod-1:5000')
# I want this to work
I would not want to ask my developers to change the application to use FQDN.
Is there any way cluster can identify if URL resolves to a service present within the network and if it happens do not route the request to proxy ?
答案1
得分: 2
支持http_proxy
环境变量的库通常也支持一个匹配的no_proxy
,用于指定不应代理的内容。确切的语法似乎因语言和库而异,但普遍的规则是将no_proxy=example.com
设置为不代理anything.example.com
。
这很重要,因为Kubernetes DNS系统根据集群名称创建其名称,默认为cluster.local
。例如,服务DNS名称的规范形式是service-name.namespace-name.svc.cluster.local.
,其中service-name
和namespace-name
是相应的Kubernetes对象的名称。
我怀疑这意味着可以执行两个操作:
- 设置环境变量
no_proxy=cluster.local
; - 确保在调用其他服务时使用FQDN形式,如
service.namespace.svc.cluster.local
。
Pods具有类似的命名,但位于pod.cluster.local
子域中。cluster.local
的值可以在集群级别进行配置,可能在您的环境中不同。
英文:
Libraries that support the http_proxy
environment variable generally also support a matching no_proxy
that names things that shouldn't be proxied. The exact syntax seems to vary across languages and libraries but it does seem to be universal that setting no_proxy=example.com
causes anything.example.com
to not be proxied either.
This is relevant because the Kubernetes DNS system creates its names in a domain based on the cluster name, by default cluster.local
. The canonical form of a Service DNS name, for example, is service-name.namespace-name.svc.cluster.local.
, where service-name
and namespace-name
are the names of the corresponding Kubernetes objects.
I suspect this means it would work to do two things:
- Set an environment variable
no_proxy=cluster.local
; and - Make sure to use the FQDN form when calling other services,
service.namespace.svc.cluster.local
.
Pods have similar naming, but are in a pod.cluster.local
subdomain. The cluster.local
value is configurable at a cluster level and it may be different in your environment.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论