Bug 1825923

[Description of problem]

When a wide-cluster proxy is defined using in noproxy a CIDR format, the fluentd pod tryes to use the proxy always and doesn't honor the noproxy definition if you try to access by the IP address in the CIDR range.

This doesn't happen when a host is specified in the noproxy definition.

Use always the proxy when defined in CIDR format:

noProxy: 10.74.176.0/20,...

Don't use the proxy when defined like:

noProxy: 10.74.178.10,...

[Version-Release number of selected component (if applicable)]

Tested in OCP 4.3.10 and 4.3.12


[How reproducible]
Always


[Steps to Reproduce]

1. Define a wide-cluster proxy like this

~~~
apiVersion: config.openshift.io/v1
kind: Proxy
metadata:
...
spec:
  httpProxy: http://squid.corp.redhat.com:8080
  noProxy: .cluster.local,.svc,10.0.0.0/16,10.128.0.0/14,127.0.0.1,172.30.0.0/16,api-int.example.com,etcd-0.example.com,localhost,10.74.176.0/20
...
~~~

2. Delete fluentd pods for taking care of the new proxy definition
3. Check proxy env definition

~~~
http_proxy=http://proxy.example.com:8080
no_proxy=.cluster.local,.svc,10.0.0.0/16,10.128.0.0/14,10.74.176.0/20,127.0.0.1,172.30.0.0/16,api-int.example.com,etcd-0.example.com,localhost
HTTP_PROXY=http://proxy.example.com:8080
NO_PROXY=.cluster.local,.svc,10.0.0.0/16,10.128.0.0/14,10.74.176.0/20,127.0.0.1,172.30.0.0/16,api-int.example.com,etcd-0.example.com,localhost
~~~

4. Curl to an IP in the CIDR "14,10.74.176.0/20" and check how it's trying to use the proxy

~~~
$ oc rsh <fluentd pod>
sh-4.2# curl -vvv http://10.74.176.10:9300 -vvv
* About to connect() to proxy proxy.example.com port 8080 (#0)
*   Trying 10.11.5.35...
* Connected to proxy.example.com (10.11.5.35) port 8080 (#0)
> GET http://10.74.176.10:9300/ HTTP/1.1
> User-Agent: curl/7.29.0
> Host: 10.74.176.10:9300
> Accept: */*
> Proxy-Connection: Keep-Alive
> 

~~~ 

[Actual results]

Fluentd pod is not honoring the noproxy definition and it uses the proxy


[Expected results]

Fluentd pod honors the noproxy definition and not use the proxy for the defined noproxy entries.

[Additional information]

A similar BZ1768762 [1] was created where it's mentioned by Ben Parees in #C12 [2] the next: "2) Need to confirm the fluentd transport libraries support CIDR format noproxy values.  If they do not, we are going to need to find another way to ensure the requests from fluentd to elastic are not proxied." 

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1768762
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1768762#c12