Allow manually started docker containers to have internet access

[ghost]

Is this a BUG REPORT or FEATURE REQUEST? (choose one): FEATURE REQUEST

Environment:

• Cloud provider or hardware configuration: Bare Metal
  Kubespray version (commit) (git rev-parse --short HEAD): 00916de
  Network plugin used: Calico

Anything else do we need to know:
Normally kubespray totally disables docker networking with --ip-masq=false and --iptables=false so when I start a docker container outside of kubernetes it won't have access to any network specially internet. Sometimes this is necessary, like when I want to use a application that needs internet access and doesn't have kubernetes manifest or more importantly when I use Docker-out-side-of-Docker for CI/CD pipelines and jobs creates docker containers when I run docker build inside kubernetes powered runner, the new container does not have internet access and I can't build docker image. I've manually added following iptables rule and enabled internet access.

iptables -t nat -A POSTROUTING -s 172.17.0.0/16 ! -d 10.0.0.0/8 -m addrtype ! --dst-type LOCAL -j MASQUERADE

[MatthiasLohr]

Yes, please!

[bal291]

yes I am having the same issues.

[ssbarnea]

I can confirm that the iptables command did fix the issue, now the question is how to make this part of kubespray? I don't want to deploy it manually or to worry that reboot will mess it.

[manics]

kubespray has a docker_iptables_enabled variable:

kubespray/roles/kubespray-defaults/defaults/main.yaml

Line 191 in 2051bf2

docker_iptables_enabled: "false"

[ssbarnea]

@manics is this parameter enough to enable internet access? (same effects as the previous iptables line?). If true, we need to update the comment above that line in ordert to inform user about its side-effect.

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[zerohoon0102]

After modifying

kubespray/inventory/sample/group_vars/k8s-cluster/k8s-cluster.yml

Line 98 in 2051bf2

kube_proxy_mode: ipvs

to iptable and

kubespray/inventory/sample/group_vars/all/docker.yml

Line 19 in 2051bf2

docker_iptables_enabled: "false"

to "true", jenkins started building the image normally.