How to avoid proxies interferring with /api/v1/namespaces/{namespace}/pods/{name}/proxy/

[brenton]

In many cases admins set HTTP{S}_PROXY and NO_PROXY when the Master, Node or Docker need to be configured for proxies. The challenge with NO_PROXY has been that while it can accept zones or hostnames or IPs it can't be set to cidr ranges. When the Master proxies to a pod it does so over the Pod IP. It's not practical (or really even possible) to set all the Pod IPs in the NO_PROXY setting.

This makes me think this situation may have to be special cased. I suspect the vast majority of environments will not want to use a proxy for the Master->Pod communication. However, I'm certain someone will. Should some configuration like this be added to the Master config? Perhaps a boolean setting that would tell the Master to obey the normal environment variables when reaching Pod. The default would be to ignore them for the proxy API calls.

[brenton]

@liggitt, thoughts?

[sdodson]

/me nominates this for P1 if my global proxy config stuff is to happen for 3.2 we need to sort this and the linked issue out.

[sdodson]

@danmcp I believe this is a blocker if we want 'Global Proxy' as a 1.2/3.2 feature.

[deads2k]

Opened kubernetes/kubernetes#23003 upstream