kubefwd icon indicating copy to clipboard operation
kubefwd copied to clipboard

Option to restart forwarding on TLS connection reset.

Open apjoseph opened this issue 1 year ago • 1 comments

First off let me say thank you for producing this library, Wish I had discovered it earlier -would have saved me a great many headaches over the years!

Due to a severe bug (kubernetes/kubernetes#111825) affecting kubectl versions>=1.23.6, kubectl port forwarding is currently broken for any service that utilizes TLS. In searching for alternatives to kubectl port forward, I found kubefwd. Unfortunately kubefwd is affected as well since it utilizes the same go client:

←[36mINFO←[0m[18:01:27] Port-Forward:       127.1.27.2 my-pg-svc:5432 to pod ag-1:5432
←[31mERRO←[0m[18:02:23] Runtime: an error occurred forwarding 5432 -> 5432: error forwarding port 5432 to pod 81df427aa522bfa115d0540e697996902eac87d6f67a89ba6866561a9605558b, uid : failed to execute portforward in network namespace "/var/run/netns/cni-5d41cf8f-7a06-167a-b72f-d4c30a123f96": read tcp4 127.0.0.1:34794->127.0.0.1:5432: read: connection reset by peer
←[31mERRO←[0m[18:02:23] Runtime: lost connection to pod
←[33mWARN←[0m[18:02:23] Stopped forwarding pod my-postgres-svc-1 for my-pg-svc.app-dev.microk8s

A succinct description of the cause can be found here. The bug is also the cause of #225

The Kubernetes team has been aware of this critical flaw for nearly a year, but hasn't implemented any fix or even suggested a plausible workaround, -despite it effectively making port-forwarding a non-option for anyone who uses Postgres (or any service) with SSL.

As such, it would be incredibly helpful if kubefwd were to add the ability to reestablish lost connections. It may be an imperfect solution but it would be very useful to Postgres users who currently have to choose between disabling SSL, exposing Postgres directly over the internet, or setting up a VPN.

apjoseph avatar Jun 07 '23 12:06 apjoseph