<p>I have a question about kubernetes and network firewall rules. I want to secure my kubernetes cluster with firewall rules, and was wondering if workers/masters need internet access? I'm planning on using a private registry located on my network, but I'm having problems getting it to work when the workers don't have internet access. Here's an example</p>

<pre><code>Name:           foo
Namespace:      default
Node:           worker003/192.168.30.1
Start Time:     Mon, 23 Jan 2017 10:33:07 -0500
Labels:         &lt;none&gt;
Status:         Pending
IP:
Controllers:    &lt;none&gt;
Containers:
  foo:
    Container ID:
    Image:              registry.company.org/wop_java/app:nginx
    Image ID:
    Port:
    State:              Waiting
      Reason:           ContainerCreating
    Ready:              False
    Restart Count:      0
    Volume Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-3cg0w (ro)
    Environment Variables:      &lt;none&gt;
Conditions:
  Type          Status
  Initialized   True
  Ready         False
  PodScheduled  True
Volumes:
  default-token-3cg0w:
    Type:       Secret (a volume populated by a Secret)
    SecretName: default-token-3cg0w
QoS Class:      BestEffort
Tolerations:    &lt;none&gt;
Events:
  FirstSeen     LastSeen        Count   From                            SubObjectPath   Type        Reason              Message
  ---------     --------        -----   ----                            -------------   --------    ------              -------
  5m            5m              1       {default-scheduler }                            Normal      Scheduled   Successfully assigned foo to worker003
  4m            1m              4       {kubelet worker003}                     Warning     FailedSync  Error syncing pod, skipping: failed to "StartContainer" for "POD" with ErrImagePull: "image pull failed for gcr.io/google_containers/pause-amd64:3.0, this may be because there are no credentials on this request.  details: (Error response from daemon: {\"message\":\"Get https://gcr.io/v1/_ping: dial tcp 74.125.192.82:443: i/o timeout\"})"

  3m    3s      9       {kubelet worker003}             Warning FailedSync      Error syncing pod, skipping: failed to "StartContainer" for "POD" with ImagePullBackOff: "Back-off pulling image \"gcr.io/google_containers/pause-amd64:3.0\""
</code></pre>

<p>My question is, does kubernetes require internet access to work? If yes, where is it documented officially?</p>

<p>you need to pass an argument <code>--pod-infra-container-image</code> to a <strong>kubelet</strong> as documented here: <a href="https://kubernetes.io/docs/admin/kubelet/" rel="nofollow noreferrer">https://kubernetes.io/docs/admin/kubelet/</a>.
It defaults to <code>gcr.io/google_containers/pause-amd64:3.0</code>, which in unsuccessfuly pulled on your machine since gcr.io is unavailable. </p>

<p>You can easily transfer the pause image to you private registry</p>

<pre><code>docker pull gcr.io/google_containers/pause-amd64:3.0
docker tag gcr.io/google_containers/pause-amd64:3.0 REGISTRY.PRIVATE/google_containers/pause-amd64:3.0
docker push REGISTRY.PRIVATE/google_containers/pause-amd64:3.0

# and pass
kubelet --pod-infra-container-image=REGISTRY.PRIVATE/google_containers/pause-amd64:3.0 ...
</code></pre>

<p>The pause is a container is created prior your container in order to allocate and keep network and ipc namespaces over restarts.</p>
