企业代理环境下Docker与Kubernetes代理配置规范问询

Hey there, let's walk through properly configuring Docker and Kubernetes proxies in an enterprise environment—this is a super common gotcha, so I’ll break it down step by step.

1. First: The Basics of Proxy Environment Variables #

Let’s clear up the confusion around http_proxy syntax and casing first:

• Correct syntax for proxy URLs: You must include the protocol (http:// or https://). So either export http_proxy="http://1.2.3.4:8080" or export http_proxy=http://1.2.3.4:8080 works (quotes are optional unless your proxy URL has special characters like @). Do NOT use just 1.2.3.4:8080—most tools (including Docker and Kubernetes components) rely on the protocol to properly route traffic through the proxy.
• Casing matters (sort of): Different tools have different conventions—some look for lowercase http_proxy, others uppercase HTTP_PROXY. To cover all bases, set both:

  export http_proxy="http://1.2.3.4:8080"
  export HTTP_PROXY="http://1.2.3.4:8080"
  export https_proxy="http://1.2.3.4:8080"
  export HTTPS_PROXY="http://1.2.3.4:8080"
  export no_proxy="localhost,127.0.0.1,10.0.0.0/8"
  export NO_PROXY="localhost,127.0.0.1,10.0.0.0/8"
  

2. Configuring Docker Proxy (Permanent Setup) #

Using export only sets the proxy for your current shell session—once you restart Docker or log out, it’s gone. For a permanent setup, you need to edit Docker’s systemd service configuration:

1. Create the systemd drop-in directory if it doesn’t exist:

   sudo mkdir -p /etc/systemd/system/docker.service.d
   

2. Create a http-proxy.conf file inside that directory with your proxy settings:

   [Service]
   Environment="HTTP_PROXY=http://1.2.3.4:8080/"
   Environment="HTTPS_PROXY=http://1.2.3.4:8080/"
   Environment="NO_PROXY=localhost,127.0.0.1,10.0.0.0/8,192.168.0.0/16,172.16.0.0/12"
   

   • The NO_PROXY here should include your Kubernetes cluster’s pod/service networks (the private IP ranges your cluster uses) plus local loopback addresses. Using CIDR notation (like 10.0.0.0/8) is way more efficient than listing every node IP individually.
3. Reload systemd and restart Docker to apply changes:

   sudo systemctl daemon-reload
   sudo systemctl restart docker
   

4. Verify the settings worked by running:

   docker info | grep -i proxy
   

3. Configuring Kubernetes Proxy Settings #

Kubernetes has multiple components that need proxy config—let’s cover the key ones:

a. Kubelet (Worker & Control Plane Nodes) #

The kubelet runs as a systemd service, so we use the same drop-in method as Docker:

1. Create the drop-in directory:

   sudo mkdir -p /etc/systemd/system/kubelet.service.d
   

2. Create a proxy.conf file:

   [Service]
   Environment="HTTP_PROXY=http://1.2.3.4:8080/"
   Environment="HTTPS_PROXY=http://1.2.3.4:8080/"
   Environment="NO_PROXY=localhost,127.0.0.1,10.0.0.0/8,192.168.0.0/16,172.16.0.0/12,kubernetes.default.svc"
   

   • Add kubernetes.default.svc to NO_PROXY to ensure the kubelet can communicate with the API server without going through the proxy.
3. Reload and restart the kubelet:

   sudo systemctl daemon-reload
   sudo systemctl restart kubelet
   

b. Control Plane Components (kube-apiserver, kube-controller-manager, kube-scheduler) #

If these are running as systemd services (common in bare-metal or self-managed clusters), add the same Environment lines to their respective systemd service files (e.g., /etc/systemd/system/kube-apiserver.service). Don’t forget to include internal cluster addresses in NO_PROXY to avoid breaking internal communication.

c. Pod-Level Proxy #

If your application pods need to access external resources via the proxy, set the proxy environment variables directly in your Pod manifest:

apiVersion: v1
kind: Pod
metadata:
  name: my-app-pod
spec:
  containers:
  - name: my-app
    image: my-app-image
    env:
    - name: HTTP_PROXY
      value: "http://1.2.3.4:8080"
    - name: HTTPS_PROXY
      value: "http://1.2.3.4:8080"
    - name: NO_PROXY
      value: "localhost,127.0.0.1,10.0.0.0/8"

For a cluster-wide setup, you can use a ConfigMap to inject these variables into all pods automatically.

4. Key Notes on NO_PROXY #

• Use CIDR notation: Instead of listing every Kubernetes node IP (10.0.0.1,10.0.0.2,...), use CIDR ranges like 10.0.0.0/8 to cover all private IPs in that subnet. This is more maintainable as your cluster scales.
• Include critical internal addresses: Always add localhost, 127.0.0.1, your cluster’s pod/service CIDRs, and the Kubernetes service cluster IP (usually kubernetes.default.svc) to NO_PROXY—this prevents internal cluster traffic from being routed through the enterprise proxy, which would cause failures.
• No spaces: Separate entries with commas and no spaces—some tools (like curl) will ignore entries with spaces.

内容的提问来源于stack exchange，提问作者hokwang