How to set proxy settings (http_proxy variables) for kubernetes (v1.11.2) cluster?

Question

I have setup a Kubernetes cluster which somehow cannot have internet connectivity because of organizaion policies. Now there are some services which I need to communicate via internet. To resolve this I have setup a forward proxy (Squid) which is outside of K8s cluster. All the nodes of my K8s cluster can access "google.com" using forward proxy. But I am not able to make my pods communicate through that proxy.

I have setup following variable on all the master and worker nodes:

export http_proxy="http://10.x.x.x:3128"
export https_proxy="https://10.x.x.x:3128"

I am able to curl google.com from master and worker nodes. But when I attach into my container I notice that there are no variable http_proxy and https_proxy. and it cannot perform successful curl.

My pods and service network is different than my VM network

pod-network-cidr=192.167.0.0/16 
service-cidr 192.168.0.0/16 

and my VM network is like:

Master  -> 10.2.2.40
Worker1 -> 10.2.2.41
Worker2 -> 10.2.2.42
Worker3 -> 10.2.2.43

And my forward proxy is running at

Forward Proxy: 10.5.2.30

I am using kubernetes version v1.11.2. Any help here like where should I put my http_proxy setting for kubernetes cluster to make it effective for all pods and services?

Solution 1

So I figured it out that to set the proxy for particular containers, set the env variable in Dockerfile.

ENV HTTP_PROXY http://10.x.x.x:PORT

Solution 2

For the docker service, use the systemd settings files:

Create a file:

/etc/systemd/system/docker.service.d/http-proxy.conf

With the content:

[Service]
Environment="HTTP_PROXY=http://10.x.x.x:3128"
Environment="HTTPS_PROXY=http://10.x.x.x:3128"

(you could also include NO_PROXY variables)

You'll need to reload systemctl and restart the docker service:

systemctl daemon-reload
systemctl restart docker

For the containers to be able to connect to the proxy use /etc/default/docker or /etc/sysconfig/docker as mk_sta said.

Solution 3

You can add http_proxy setting to your Docker machine in order to forward packets from the nested Pod container through the target proxy server.

For Ubuntu based operating system:

Add export http_proxy='http://<host>:<port>' record to the file /etc/default/docker

For Centos based operating system:

Add export http_proxy='http://<host>:<port>' record to the file /etc/sysconfig/docker

Afterwards restart Docker service.

Comments

[Meta-Coder]

Your proposed solution will set the proxy for all containers that will be using this docker engine. Due to which i will not consider it the right answer.