Disable Kubernetes ClusterIP service environment variables on pods

Question

Whenever a new pod is created in the cluster, environment variables related to the default Kubernetes clusterIP service are being injected into it.

Kubernetes clusterIp service running:

NAME                        TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
kubernetes                  ClusterIP   10.116.0.1     <none>        443/TCP    27d

No matter on which namespace the pod is running, the following env vars will always appear:

KUBERNETES_SERVICE_PORT=443
KUBERNETES_PORT=tcp://10.116.0.1:443
KUBERNETES_PORT_443_TCP_ADDR=10.116.0.1
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT_443_TCP=tcp://10.116.0.1:443
KUBERNETES_SERVICE_HOST=10.116.0.1

I'm using enableServiceLinks=false as a mechanism to avoid service environment variables to be injected into pods, but it looks like it doesn't work for the default Kubernetes clusterIp service.

Deployment manifest:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: indecision-app-deployment
  labels:
    app: indecision-app
spec:
  selector:
    matchLabels:
      app: indecision-app
  template:
    metadata:
      labels:
        app: indecision-app
    spec:
      enableServiceLinks: false
      containers:
      - name: indecision-app
        image: hleal18/indecision-app:latest
        ports:
        - containerPort: 8080

Is it expected that enableServiceLinks=false also avoids the default Kubernetes clusterIP service of being injected?

score 0 · Accepted Answer · answered Jun 22 '20 at 09:38

In k8s source code you can find this comment:

// We always want to add environment variabled for master services
// from the master service namespace, even if enableServiceLinks is false.

and the code that adds these environemt variables:

if service.Namespace == kl.masterServiceNamespace && masterServices.Has(serviceName) {
    if _, exists := serviceMap[serviceName]; !exists {
        serviceMap[serviceName] = service
}

As you can see, kubelet adds services from masterServiceNamespace which defaults to "default".

Digging a bit more I have found out that there is a flag --master-service-namespace

--master-service-namespace The namespace from which the kubernetes master services should be injected into pods (default "default") (DEPRECATED: This flag will be removed in a future version.)

Now the flag is depricated and may be deleted in future.

Setting it on every kubelet should solve your issue but this is probably not the best thing to do as it is probably depricated for a reason.

Thanks for your response. You're right, it is deprecated and some github issues even say the flag will simply be ignored by the apiserver. Looks like there's no easy way to get rid of those env vars, since the pods we're talking about are untrusted, so better not to inject extra info. — hleal18, Jun 23 '20 at 19:46

Disable Kubernetes ClusterIP service environment variables on pods

1 Answers1