Proxy configuration for Image Pull only

[thomasdanan]

Component:

'containerd'

Why this is needed:

In some customer environments, cluster nodes are not connected to the internet. When it comes to download images from the internet, we usually use a proxy, which is external to the cluster. We suggested in our documentation to add proxy configuration in /etc/environment on all hosts so that 'containerd' pulls image through the proxy. The issue with that approach is that all pods running on the host will also try to access other services through this proxy and it will fail unless you configure every endpoint, which is not what we want.

What should be done:

We would like to configure the system so that a proxy can be used, only for pulling images but without affecting the traffic between pods.

Implementation proposal (strongly recommended):

Test plan:

[alexandre-allard]

This issue can be workaround by appending the following in /etc/systemd/system/containerd.service.d/50-metalk8s.conf:

Environment="HTTP_PROXY=http://proxy-ip:proxy-port HTTPS_PROXY=https://proxy-ip:proxy-port NO_PROXY=<metalk8s networks>"

Where <metalk8s networks> is the comma-separated list of both kubernetes internal networks and hosts networks.
To retrieve this list, this command can be run, on one of the metalk8s host:

salt-call slsutil.renderer string=’{% from "metalk8s/map.jinja" import networks with context %}{{ networks.values() | join(",") }}’ saltenv=metalk8s-<metalk8s-version>

<metalk8s-version> must be replaced by the version currently installed (e.g. 2.4.1)