-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Extending the no_proxy env variable to automatically include all the nodes of the cluster #2885
Conversation
Hi @wherka-ama. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
…external load balancer and etc roles(as they may be created implicitly) to complete the picture
/retest |
@wherka-ama: Cannot trigger testing until a trusted user reviews the PR and leaves an In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
/cc @BenTheElder @aojea |
/ok-to-test |
// Note: this is best effort based on the default CoreDNS spec | ||
// https://github.com/kubernetes/dns/blob/master/docs/specification.md | ||
// Any user created pod/service hostnames, namespaces, custom DNS services | ||
// are expected to be no-proxied by the user explicitly. | ||
var clusterNodeNames []string |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we should probably just restructure to pass these in or add them to the list at the call site?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was thinking in adding them here
kind/pkg/cluster/internal/providers/common/proxy.go
Lines 41 to 63 in b6bc112
func getProxyEnvs(cfg *config.Cluster, getEnv func(string) string) map[string]string { | |
envs := make(map[string]string) | |
for _, name := range []string{HTTPProxy, HTTPSProxy, NOProxy} { | |
val := getEnv(name) | |
if val == "" { | |
val = getEnv(strings.ToLower(name)) | |
} | |
if val != "" { | |
envs[name] = val | |
envs[strings.ToLower(name)] = val | |
} | |
} | |
// Specifically add the cluster subnets to NO_PROXY if we are using a proxy | |
if len(envs) > 0 { | |
noProxy := envs[NOProxy] | |
if noProxy != "" { | |
noProxy += "," | |
} | |
noProxy += cfg.Networking.ServiceSubnet + "," + cfg.Networking.PodSubnet | |
envs[NOProxy] = noProxy | |
envs[strings.ToLower(NOProxy)] = noProxy | |
} | |
return envs |
that will cascade for all the providers
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The docker implementation already has this AFAICT, we just need to modify podman to match and drop the docker changes, I think #2885 (comment)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think it's worth moving to common, it's fairly noise to plumb any deeper as we just need to append the names
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If we were to match the podman flow with the docker one in that regard I guess the best option to start the restructuring from the planCreation
and trickle it down. I'd be happy to do that.
My entrypoint would be:
genericArgs, err := commonArgs(cfg, networkName) |
And the reference:
kind/pkg/cluster/internal/providers/docker/provision.go
Lines 42 to 53 in b2ed53e
names := make([]string, len(cfg.Nodes)) | |
for i, node := range cfg.Nodes { | |
name := nodeNamer(string(node.Role)) // name the node | |
names[i] = name | |
} | |
haveLoadbalancer := config.ClusterHasImplicitLoadBalancer(cfg) | |
if haveLoadbalancer { | |
names = append(names, nodeNamer(constants.ExternalLoadBalancerNodeRoleValue)) | |
} | |
// these apply to all container creation | |
genericArgs, err := commonArgs(cfg.Name, cfg, networkName, names) |
@BenTheElder @aojea : are you fine with that direction?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've just pushed a fresh commit with the refactoring. In short - it's an alignment with what we have for docker in that regards. I must admit I like this version a lot more than the previous one. I hope you don't disagree ;-)
/cc @BenTheElder @aojea
@@ -286,12 +286,22 @@ func getProxyEnv(cfg *config.Cluster, networkName string, nodeNames []string) (m | |||
|
|||
noProxyList := append(subnets, envs[common.NOProxy]) | |||
noProxyList = append(noProxyList, nodeNames...) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
aren't we already adding these here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good point! Indeed it looks like we can revert for docker and try to pass the list the same way as it's done here indeed.. I'll do it right away. Thanks!
…ser to what's done for docker
/lgtm |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: aojea, wherka-ama The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
See: #2884