K
Q

Does kubernetes require internet access when using a private registry?

1/23/2017

I have a question about kubernetes and network firewall rules. I want to secure my kubernetes cluster with firewall rules, and was wondering if workers/masters need internet access? I'm planning on using a private registry located on my network, but I'm having problems getting it to work when the workers don't have internet access. Here's an example

Name:           foo
Namespace:      default
Node:           worker003/192.168.30.1
Start Time:     Mon, 23 Jan 2017 10:33:07 -0500
Labels:         <none>
Status:         Pending
IP:
Controllers:    <none>
Containers:
  foo:
    Container ID:
    Image:              registry.company.org/wop_java/app:nginx
    Image ID:
    Port:
    State:              Waiting
      Reason:           ContainerCreating
    Ready:              False
    Restart Count:      0
    Volume Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-3cg0w (ro)
    Environment Variables:      <none>
Conditions:
  Type          Status
  Initialized   True
  Ready         False
  PodScheduled  True
Volumes:
  default-token-3cg0w:
    Type:       Secret (a volume populated by a Secret)
    SecretName: default-token-3cg0w
QoS Class:      BestEffort
Tolerations:    <none>
Events:
  FirstSeen     LastSeen        Count   From                            SubObjectPath   Type        Reason              Message
  ---------     --------        -----   ----                            -------------   --------    ------              -------
  5m            5m              1       {default-scheduler }                            Normal      Scheduled   Successfully assigned foo to worker003
  4m            1m              4       {kubelet worker003}                     Warning     FailedSync  Error syncing pod, skipping: failed to "StartContainer" for "POD" with ErrImagePull: "image pull failed for gcr.io/google_containers/pause-amd64:3.0, this may be because there are no credentials on this request.  details: (Error response from daemon: {\"message\":\"Get https://gcr.io/v1/_ping: dial tcp 74.125.192.82:443: i/o timeout\"})"

  3m    3s      9       {kubelet worker003}             Warning FailedSync      Error syncing pod, skipping: failed to "StartContainer" for "POD" with ImagePullBackOff: "Back-off pulling image \"gcr.io/google_containers/pause-amd64:3.0\""

My question is, does kubernetes require internet access to work? If yes, where is it documented officially?

-- Francis
firewall
kubernetes
networking
security

Similar Questions

Jenkins kubernetes with google cloud kubectl not found
Change kubernetes master env variable on GKE
Jenkins timeout waiting for container to become ready
Manage replicas count for deployment using Kubernetes API

3 Answers

2/23/2017

they do not need Internet access but your not getting access to the private registry your designating. have you looked at https://kubernetes.io/docs/user-guide/images/ it has a couple good options on how to get access to the private registry. https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ also has some details on it. we do the specifing imagePullSecrets and it works fine

-- JamStar
Source: StackOverflow
2/6/2017

you need to pass an argument --pod-infra-container-image to a kubelet as documented here: https://kubernetes.io/docs/admin/kubelet/. It defaults to gcr.io/google_containers/pause-amd64:3.0, which in unsuccessfuly pulled on your machine since gcr.io is unavailable.

You can easily transfer the pause image to you private registry

docker pull gcr.io/google_containers/pause-amd64:3.0
docker tag gcr.io/google_containers/pause-amd64:3.0 REGISTRY.PRIVATE/google_containers/pause-amd64:3.0
docker push REGISTRY.PRIVATE/google_containers/pause-amd64:3.0

# and pass
kubelet --pod-infra-container-image=REGISTRY.PRIVATE/google_containers/pause-amd64:3.0 ...

The pause is a container is created prior your container in order to allocate and keep network and ipc namespaces over restarts.

-- dohnto
Source: StackOverflow
1/23/2017

Kubernetes does not need any internet access for normal operation when all required containers and components are provided by the private repository. A good starting point is the Bare Metal offline provisioning guide.

-- pagid
Source: StackOverflow