NO_PROXY/no_proxy env vars not working as expected, as of 34.1.0 #2460
Description
What happened (please include outputs or screenshots):
Upgrading libraries in one of my images. Last image was built 4 days ago, works fine. We were running kubernetes 33.1.0.
Today's image is pulling 34.1.0. KO
Picking apart each package version that changed as of my previous image, I ended up suspecting kubernetes client itself.
v33.1.0...v34.1.0
Obviously, this:
e3b373f#diff-977bedbaf9339b25749bc96a24266c1fa3e99ab521a835562fe84b2ab87b7001
And then again, the rest client, which is the one throwing in my case, looks OK?
https://github.com/kubernetes-client/python/blob/master/kubernetes/client/rest.py
That "should_bypass_proxy" ... looks correct ...
https://requests.readthedocs.io/en/latest/_modules/requests/utils/
We are using proxies. Ansible would connect public services (eg: aws). Our proxies would only allow for specific names out.
Ansible would connect to our clusters directly/no proxy.
Our environment would include:
HTTP_PROXY: http://my-http-proxy:8080
HTTPS_PROXY: http://my-http-proxy:8080
NO_PROXY: github.corp.com,.github.corp.com,localhost,.local,.svc,10.0.0.0/8,127.0.0.0/8,127.0.0.1,::1,.corp.com
http_proxy: http://my-http-proxy:8080
https_proxy: http://my-http-proxy:8080
no_proxy: github.corp.com,.github.corp.com,localhost,.local,.svc,10.0.0.0/8,127.0.0.0/8,127.0.0.1,::1,.corp.com
My cluster FQDNs would follow format <cluster-name>.<where-it-runs>.corp.com
So far, and testing again with my previous images running 33.1.0, connections to AWS exits through proxies, connections to clusters exits directly.
Testing 34.1.0, connection to clusters are mistakenly sent to my proxy, which denies the request.
Forcing HTTPS_PROXY/https_proxy to empty string, when calling my terraform provider: access to cluster OK, but then I broke access to AWS.
I lost that link, but I found somewhere suggesting that some client may handle subdomains differently, so I tried to add corp.com alongside my previous .corp.com, in no_proxy env var. Still no luck.
Then I tried adding the exact cluster FQDN to no_proxy env var: I can still see ansible connecting through my proxies.
What you expected to happen:
domains/subdomains listed in my NO_PROXY/no_proxy should be connected to directly.
How to reproduce it (as minimally and precisely as possible):
Set proxy variables as shown above. Include Kubernetes cluster domain in no_proxy.
Switch from 33.1.0 to 34.1.0. check access logs in proxy.
Anything else we need to know?:
Environment:
- Kubernetes version (
kubectl version): 1.29.7 - OS (e.g., MacOS 10.13.6): RHEL9
- Python version (
python --version): 3.9 - Python client version (
pip list | grep kubernetes): 34.1.0