Accessing internal services
- Suspension of disbelief
kubectl proxyin theory
kubectl proxyin practice
kubectl port-forwardin theory
kubectl port-forwardin practice
When we are logged in on a cluster node, we can access internal services
(by virtue of the Kubernetes network model: all nodes can reach all pods and services)
When we are accessing a remote cluster, things are different
(generally, our local machine won't have access to the cluster's internal subnet)
How can we temporarily access a service without exposing it to everyone?
kubectl proxy: gives us access to the API, which includes a proxy for HTTP resources
kubectl port-forward: allows forwarding of TCP ports to arbitrary pods, services, ...
Suspension of disbelief
The exercises in this section assume that we have set up
kubectl on our
local machine in order to access a remote cluster.
We will therefore show how to access services and pods of the remote cluster, from our local machine.
You can also run these exercises directly on the cluster (if you haven't
installed and set up
Running commands locally will be less useful
(since you could access services and pods directly),
but keep in mind that these commands will work anywhere as long as you have
installed and set up
kubectl to communicate with your cluster.
kubectl proxy in theory
kubectl proxygives us access to the entire Kubernetes API
The API includes routes to proxy HTTP traffic
These routes look like the following:
We just add the URI to the end of the request, for instance:
We can access
kubectl proxy in practice
- Let's access the
Run an API proxy in the background:
kubectl proxy &
Terminate the proxy:
kubectl port-forward in theory
What if we want to access a TCP service?
We can use
It will create a TCP relay to forward connections to a specific port
(of a pod, service, deployment...)
The syntax is:
kubectl port-forward service/name_of_service local_port:remote_port
If only one port number is specified, it is used for both local and remote ports
kubectl port-forward in practice
- Let's access our remote Redis server
Forward connections from local port 10000 to remote port 6379:
kubectl port-forward svc/redis 10000:6379 &
Connect to the Redis server:
telnet localhost 10000
Issue a few commands, e.g.
Terminate the port forwarder: