fix(proxy): NO_PROXY covers the cloud metadata IP (chart + both installers)

client/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: client
 description: A unified Helm chart for tracebloc on AKS, EKS, bare-metal, and OpenShift
 type: application
-version: 1.9.3
-appVersion: "1.9.3"
+version: 1.9.4
+appVersion: "1.9.4"
 keywords:
   - tracebloc
   - kubernetes

client/templates/_helpers.tpl

@@ -236,7 +236,7 @@ Usage inside a container's env: list:
 {{- $cred := "" -}}
 {{- if $user }}{{- $cred = printf "%s:%s@" $user $pass -}}{{- end -}}
 {{- $url := printf "http://%s%s" $cred $hostport -}}
-{{- $noProxy := "localhost,127.0.0.1,0.0.0.0,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.svc.cluster.local,.cluster.local,host.k3d.internal" -}}
+{{- $noProxy := "localhost,127.0.0.1,0.0.0.0,169.254.169.254,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.svc.cluster.local,.cluster.local,host.k3d.internal" -}}
 {{- with .Values.env.NO_PROXY }}{{- $noProxy = printf "%s,%s" . $noProxy -}}{{- end }}
 - name: HTTP_PROXY
   value: {{ $url | quote }}

client/tests/proxy_env_test.yaml

@@ -56,7 +56,7 @@ tests:
           content: {name: HTTP_PROXY, value: "http://proxy.example.com:8080"}
       - contains:
           path: spec.template.spec.containers[0].env
-          content: {name: NO_PROXY, value: "localhost,127.0.0.1,0.0.0.0,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.svc.cluster.local,.cluster.local,host.k3d.internal"}
+          content: {name: NO_PROXY, value: "localhost,127.0.0.1,0.0.0.0,169.254.169.254,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.svc.cluster.local,.cluster.local,host.k3d.internal"}
   - it: jobs-manager pods-monitor gets HTTP_PROXY when a proxy is set
     template: templates/jobs-manager-deployment.yaml
     set: {env.HTTP_PROXY_HOST: proxy.example.com, env.HTTP_PROXY_PORT: "8080"}
@@ -108,14 +108,14 @@ tests:
       # api container: only the merged value (custom + cluster-internal) is present
       - contains:
           path: spec.template.spec.containers[0].env
-          content: {name: NO_PROXY, value: "myinternal.example,localhost,127.0.0.1,0.0.0.0,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.svc.cluster.local,.cluster.local,host.k3d.internal"}
+          content: {name: NO_PROXY, value: "myinternal.example,localhost,127.0.0.1,0.0.0.0,169.254.169.254,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.svc.cluster.local,.cluster.local,host.k3d.internal"}
       - notContains:
           path: spec.template.spec.containers[0].env
           content: {name: NO_PROXY, value: "myinternal.example"}
       # pods-monitor container: same guarantee
       - contains:
           path: spec.template.spec.containers[1].env
-          content: {name: NO_PROXY, value: "myinternal.example,localhost,127.0.0.1,0.0.0.0,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.svc.cluster.local,.cluster.local,host.k3d.internal"}
+          content: {name: NO_PROXY, value: "myinternal.example,localhost,127.0.0.1,0.0.0.0,169.254.169.254,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.svc.cluster.local,.cluster.local,host.k3d.internal"}
       - notContains:
           path: spec.template.spec.containers[1].env
           content: {name: NO_PROXY, value: "myinternal.example"}

scripts/install-k8s.ps1

@@ -726,7 +726,7 @@ function Install-K3dAndHelm {
 # in-cluster DNS suffixes. Echoes host NO_PROXY/no_proxy unioned with these
 # defaults, de-duplicated with host entries first.
 function Get-EffectiveNoProxy {
-  $defaults = @('localhost','127.0.0.1','0.0.0.0','10.0.0.0/8','172.16.0.0/12','192.168.0.0/16','.svc','.svc.cluster.local','.cluster.local','host.k3d.internal')
+  $defaults = @('localhost','127.0.0.1','0.0.0.0','169.254.169.254','10.0.0.0/8','172.16.0.0/12','192.168.0.0/16','.svc','.svc.cluster.local','.cluster.local','host.k3d.internal')
   $existing = if ($env:NO_PROXY) { $env:NO_PROXY } elseif ($env:no_proxy) { $env:no_proxy } else { '' }
   $seen = @{}
   $out  = New-Object System.Collections.Generic.List[string]

scripts/lib/cluster.sh

@@ -66,7 +66,7 @@ _ensure_release_dirs() {
 # a *proxied* private-IP destination can narrow this; tracebloc itself only
 # pulls from public registries + dials public api.tracebloc.io, so the broad
 # bypass is safe for the isolated VM the client runs on.)
-TB_NO_PROXY_DEFAULTS="localhost,127.0.0.1,0.0.0.0,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.svc.cluster.local,.cluster.local,host.k3d.internal"
+TB_NO_PROXY_DEFAULTS="localhost,127.0.0.1,0.0.0.0,169.254.169.254,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.svc.cluster.local,.cluster.local,host.k3d.internal"
 
 # Echo an effective NO_PROXY = host NO_PROXY/no_proxy ∪ TB_NO_PROXY_DEFAULTS,
 # de-duplicated with first-seen order preserved (host entries first).

scripts/manifest.sha256

@@ -6,11 +6,11 @@ ff17020ab0fe30bde430a54b33150084bb52c9543eabce8897706df94f0c48f5  scripts/lib/gp
 fd8d37d698c242ab081095625aa430bb91971db646e35393a02bbadd41325898  scripts/lib/gpu-amd.sh
 2552776f16a7e697034a1ba8137cc87797ebfb8b29fee84f2aa6662fd6fefbbd  scripts/lib/setup-macos.sh
 238f9bc0e344376c3883bad9e980db250799cacc9e7ce3bfc7ef37c5b5881244  scripts/lib/setup-linux.sh
-dd2e1f517b0f6bb665eacebfb7885c6a81443f69c2ebc772433a6baed53c7a8e  scripts/lib/cluster.sh
+a7dbeaa8f99a50c9d2d0bcfdb17dd14804e057f69685a6152d51f60a58602057  scripts/lib/cluster.sh
 5de1afac8b1062a7f8d0691b46ad39ccdc2287e0e422b53c48628ecfd47d852e  scripts/lib/gpu-plugins.sh
 9490b627c287655c674a09f64c148d31abe39eff81ef7e5d9a76b1313ca3bc37  scripts/lib/install-client-helm.sh
 f890cc3917b09b4b779fcd1a53b902370cb291488a7905f9d710daa871a9eb72  scripts/lib/install-cli.sh
 e983076d72485d58fa2c9293c62905f1f8f0f4ebd355f8f745a49f0f3bf0052c  scripts/lib/provision.sh
 7c5ca5fc1b3f3d5b2b699811da603b40b8879b317b1c756b8ed15da104192828  scripts/lib/summary.sh
 f22b3f57722feaf3a05a8527988c4404c27b772dd8ba8d6d4c6fe08077081a4a  scripts/lib/diagnose.sh
-8c8973117018dee6518df1b0067d681feeee27e10e42be84e52479725b9ffe5a  scripts/install-k8s.ps1
+b83e9ab7f353ef5b43c0d84fe6a8e377a3c17878d7bc968fce7f7141ab56cb16  scripts/install-k8s.ps1

scripts/tests/cluster.bats

@@ -36,6 +36,7 @@ setup() {
   run _augment_no_proxy
   [ "$status" -eq 0 ]
   [[ "$output" == *"localhost"* ]]
+  [[ "$output" == *"169.254.169.254"* ]]
   [[ "$output" == *"127.0.0.1"* ]]
   [[ "$output" == *"10.0.0.0/8"* ]]
   [[ "$output" == *".svc"* ]]

scripts/tests/install-k8s.Tests.ps1

@@ -363,6 +363,7 @@ Describe "Get-EffectiveNoProxy" {
   It "empty host NO_PROXY -> cluster-internal defaults" {
     $env:NO_PROXY = $null; $env:no_proxy = $null
     $r = Get-EffectiveNoProxy
+    $r | Should -Match '169\.254\.169\.254'
     $r | Should -Match '127\.0\.0\.1'
     $r | Should -Match '10\.0\.0\.0/8'
     $r | Should -Match '\.svc'