query: no_proxy variable not working starting from v0.36.1

[AL82082]

Hello Thanos maintainers/contributors,

I am working on a reproducible example for this issue (using docker compose) and will aim to update the issue description with all of the required bug report details by tomorrow, but I just wanted to let you know that I believe the changes to pkg/store/proxy_merge.go in v0.36.1 have resulted in no_proxy environment variable no longer being honoured.

I am using the official images from quay.io/thanos/thanos.

no_proxy environment variable appears to be working as expected in v0.35.0, v0.35.1, v0.36.0.

It does NOT appear to be working in v0.36.1 (or later).

Kind regards,
🍎

[AL82082]

Sorry for the delays with this, had some issues with docker compose and currently trying to replicate the proxy.

Just to clarify, the reasons I suspect this is broken is because when deploying image v0.36.0 query works fine, but deploying image v0.36.1 (with identical config/args) query now returns an html doc saying blocked by <name of corporate proxy> while trying to connect to store/sidecar despite no_proxy being set for the host suffix (svc.cluster.local).

Will update when I can.

[rubroboletus]

Sorry for the delays with this, had some issues with docker compose and currently trying to replicate the proxy.

Just to clarify, the reasons I suspect this is broken is because when deploying image v0.36.0 query works fine, but deploying image v0.36.1 (with identical config/args) query now returns an html doc saying blocked by <name of corporate proxy> while trying to connect to store/sidecar despite no_proxy being set for the host suffix (svc.cluster.local).

Will update when I can.

We have just discovered exactly same problem in our environment. Thanos, starting with 0.36.1 is ignoring "NO_PROXY" settings.

[AL82082]

Apologies, I've been a bit busy with other things, and had to take down (temporarily) my docker-compose POC at the behest of my org's Security...

I have approval now to re-publish this, but believe the proxy container still needs some work (I tried using mitmproxy but it doesn't work properly as-is, and might need to use something else entirely, e.g. NginX/Traefik/HAProxy).

If anyone has time and would like to assist with the reproducible example for this issue, I will post the link here once my friendly neighborhood org-admin has made the repo public again (should be soon).

[SP89443]

@rubroboletus - any idea how soon we can expect a fix for this please?

[AL82082]

@rubroboletus - any idea how soon we can expect a fix for this please?

They're not a contributor to this project, they just noticed the same issue as I did.