<p>Because my Kubernetes Cluster is behind a corporate proxy, I need to set http/https proxy in pods via environment variables and set no_proxy to allow inter-pod and inter-service communication and communication with other local private servers.  </p>

<p>Proxy http/https configuration worked perfectly when passing to the pods through env variables; but no_proxy did not work well and it breaks internal pod/service communication.  </p>

<p>I have tried unsuccessfully to set no_proxy and NO_PROXY at different levels in Kubernetes, mainly at:  </p>

<ul>
<li>Docker daemon: /etc/systemd/system/docker.service.d/http-proxy.conf</li>
<li>Docker client: /root/.docker/config.json  (although it does not seem applicable when using Docker v1.13.1 on CentOS)  </li>
<li>Docker client: through environment variables passed to the pods at creation time, in the yaml file used to run them with kubectl  </li>
<li>Kubernetes master and worker nodes as environment variables  </li>
<li>and many combinations of the above settings</li>
</ul>

<p>Proxy configuration within PODs succeeded with env variables inside the PODs:</p>

<blockquote>
  <p>export http_proxy="http://10.16.1.1:8080"<br>
  export https_proxy="https://10.16.1.1:8080"  </p>
</blockquote>

<p>But, none of the above worked for no_proxy exceptions, and I tried many syntax and also added my nodes, pod &amp; service networks, and .svc (as suggested for OpenShift)... as listed below:</p>

<blockquote>
  <p>export no_proxy=".svc,.example.com"<br>
  export no_proxy="localhost,127.0.0.0/8,10.1.16.0/24,10.240.0.0/16,10.241.0.0/16,*.domain.com"<br>
  export no_proxy=".svc,.default,.local,.cluster.local,localhost,127.0.0.0/8,10.1.16.0/24,10.240.0.0/16,10.241.0.0/16,.domain.com"<br>
  export NO_PROXY=$no_proxy  </p>
</blockquote>

<p>I am using Kubernetes v1.11.2 + Docker v1.13.1 on CentOS7;<br>
Any help would be appreciated. </p>

geomar
<p>We can make a reasonable assumption that we don't directly use IP address to access external network servers. In other words, we use FQDN to access, say python.com, google.com, github.com, but not directly using their IP addresses.</p>

<p>With this assumption, we can bypass web-proxy for all direct IP address access.</p>

<pre><code>export no_proxy=localhost,.svc
printf -v allip '%s,' .{0..255}
export no_proxy="$no_proxy,${allip%,}"
</code></pre>

<p>This adds <code>.0,.1,.2,...,.255</code> to the no_proxy env variable. There is no magic here. We just treat IP address as FQDN, so a suffix match works as FQDN no_proxy setting. Say, .120 would match all IP addresses x.x.x.122.</p>
