How can I disable / ignore proxy settings from inside a kubernetes pod only for requests directed to kubernetes services?

huangapple go评论60阅读模式
英文:

How can I disable / ignore proxy settings from inside a kubernetes pod only for requests directed to kubernetes services?

问题

我在名为main_pod的容器中设置了这些环境变量。

$ env
HTTP_PROXY=http://myproxy.com
http_proxy=http://myproxy.com

我还有另一个动态的容器,它的名称遵循模式sub_pod-{number},并附加了一个名为sub_pod-{number}的服务。

因此,如果我在main_pod中添加NO_PROXY=sub_pod-1环境变量,那么使用URL http://sub_pod-1:5000/health_check的请求将成功运行,因为它不会通过代理进行转发,这是可以接受的。

但我希望这个过程是动态的。在运行时可能会生成sub_pod-45,而sub_pod-1可能会被销毁。是否有更好的方法来处理这个问题,而不是每次创建/销毁容器时都更新NO_PROXY

是否有资源/网络策略/出口规则,可以告诉容器,如果域名属于Kubernetes服务,就不要将其路由到代理服务器?

或者我可以在NO_PROXY环境变量中简单地使用正则表达式或通配符模式,比如NO_PROXY=sub_pod-*

编辑

nslookup的结果

root@tmp-shell:/# nslookup sub_pod-1
Server:		10.43.0.10
Address:	10.43.0.10#53

Name:	sub_pod-1.default.svc.cluster.local
Address: 10.43.22.139

no_proxy=cluster.local时,

请求完全限定域名时绕过代理

res = requests.get('http://sub_pod-1.default.svc.cluster.local:5000')

只使用服务名称请求时不绕过代理

res = requests.get('http://sub_pod-1:5000') # 我希望这个能工作

我不希望要求我的开发人员更改应用程序以使用完全限定域名。

是否有办法让集群识别URL是否解析为网络中存在的服务,如果是这样,就不要将请求路由到代理?

英文:

I have set these environment variables inside my pod named main_pod.

$ env
HTTP_PROXY=http://myproxy.com
http_proxy=http://myproxy.com

I also have another dynamic pod in pattern sub_pod-{number} which has a service attached to it called sub_pod-{number}.

So, if I add NO_PROXY=sub_pod-1 environment variable in main_pod, request with URL http://sub_pod-1:5000/health_check will run successfully as it won't be directed through proxy which is fine.

But I want this process to be dynamic. sub_pod_45 might spawn at runtime and sub_pod-1 might get destroyed. Is there any better way to handle this rather than updating NO_PROXY for every pod creation / destruction ?

Is there any resource / network policy / egress rule from which I can tell pod that if domain name belongs to kubernetes service, do not route it through proxy server?

Or can I simply use regex or glob patterns in NO_PROXY env variable like NO_PROXY=sub_pod-* ?

Edited

Result of nslookup

root@tmp-shell:/# nslookup sub_pod-1
Server:		10.43.0.10
Address:	10.43.0.10#53

Name:	sub_pod-1.default.svc.cluster.local
Address: 10.43.22.139

When no_proxy=cluster.local,

Proxy bypassed when requested with FQDN

res = requests.get('http://sub_pod-1.default.svc.cluster.local:5000')

Proxy didn't bypass when requested with service name only

res = requests.get('http://sub_pod-1:5000') # I want this to work

I would not want to ask my developers to change the application to use FQDN.

Is there any way cluster can identify if URL resolves to a service present within the network and if it happens do not route the request to proxy ?

答案1

得分: 2

支持http_proxy环境变量的库通常也支持一个匹配的no_proxy,用于指定不应代理的内容。确切的语法似乎因语言和库而异,但普遍的规则是将no_proxy=example.com设置为不代理anything.example.com

这很重要,因为Kubernetes DNS系统根据集群名称创建其名称,默认为cluster.local。例如,服务DNS名称的规范形式是service-name.namespace-name.svc.cluster.local.,其中service-namenamespace-name是相应的Kubernetes对象的名称。

我怀疑这意味着可以执行两个操作:

  1. 设置环境变量no_proxy=cluster.local
  2. 确保在调用其他服务时使用FQDN形式,如service.namespace.svc.cluster.local

Pods具有类似的命名,但位于pod.cluster.local子域中。cluster.local的值可以在集群级别进行配置,可能在您的环境中不同。

英文:

Libraries that support the http_proxy environment variable generally also support a matching no_proxy that names things that shouldn't be proxied. The exact syntax seems to vary across languages and libraries but it does seem to be universal that setting no_proxy=example.com causes anything.example.com to not be proxied either.

This is relevant because the Kubernetes DNS system creates its names in a domain based on the cluster name, by default cluster.local. The canonical form of a Service DNS name, for example, is service-name.namespace-name.svc.cluster.local., where service-name and namespace-name are the names of the corresponding Kubernetes objects.

I suspect this means it would work to do two things:

  1. Set an environment variable no_proxy=cluster.local; and
  2. Make sure to use the FQDN form when calling other services, service.namespace.svc.cluster.local.

Pods have similar naming, but are in a pod.cluster.local subdomain. The cluster.local value is configurable at a cluster level and it may be different in your environment.

huangapple
  • 本文由 发表于 2023年2月7日 01:52:24
  • 转载请务必保留本文链接:https://go.coder-hub.com/75364864.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定