int128 / ktunnels

Kubernetes controller for port-forwarding from your machine to remote hosts via Envoy TCP proxy

ktunnels

This is a Kubernetes controller to set up an Envoy Proxy for port-forwarding from your computer to remote hosts.

Purpose

For local development, it is nice to develop an application using a real database. If a database is running in a private network and outside a cluster, such as Amazon RDS or Azure Database, it is unreachable from your computer.

This allows you to connect from your computer to a host outside a cluster. You just run kubectl port-forward and set up your application to connect to localhost.

This solution is an alternative of SSH or SOCKS bastion. You no longer maintain your bastion servers.

Getting Started

For administrator

Deploy the controller.

kubectl apply -f https://github.com/int128/ktunnels/releases/download/v0.8.0/ktunnels.yaml

For user

Create a Proxy resource and Tunnel resource.

# kubectl apply -f proxy.yaml
apiVersion: ktunnels.int128.github.io/v1
kind: Proxy
metadata:
  name: default

# kubectl apply -f tunnel.yaml
apiVersion: ktunnels.int128.github.io/v1
kind: Tunnel
metadata:
  name: backend-db
spec:
  host: backend-db.staging
  port: 5432
  proxy:
    name: default

Run port-forward on your computer.

kubectl port-forward svc/backend-db 5432:5432

You can connect to the database via localhost:5432.

How it works

This controller sets up a set of Deployment and ConfigMap for each proxy.

% kubectl tree proxy default
NAMESPACE  NAME                                               READY  REASON  AGE
default    Proxy/default                                      -              5m9s
default    ├─ConfigMap/ktunnels-proxy-default                 -              5m9s
default    └─Deployment/ktunnels-proxy-default                -              5m9s
default      └─ReplicaSet/ktunnels-proxy-default-5db5d68b6c   -              5m9s
default        └─Pod/ktunnels-proxy-default-5db5d68b6c-wnncc  True           5m9s

It also sets up a Service for each tunnel.

% k tree tunnel main-db
NAMESPACE  NAME                             READY  REASON  AGE
default    Tunnel/main-db                   -              32m
default    └─Service/main-db                -              32m
default      └─EndpointSlice/main-db-cxx65  -              32m

Contributions

This is an open source software licensed under Apache License 2.0. Feel free to open issues and pull requests for improving code and documents.

ktunnels's Issues

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

---

Warning

Renovate failed to look up the following dependencies: Could not determine new digest for update (github-tags package int128/docker-build-workflow), Could not determine new digest for update (github-tags package int128/kubebuilder-workflows).

Files affected: .github/workflows/docker.yaml, .github/workflows/go.yaml, .github/workflows/manifest.yaml

---

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): update dependency int128/ktunnels to v0.8.1
• fix(deps): update kubernetes packages to v0.31.0 (k8s.io/api, k8s.io/apimachinery, k8s.io/client-go)
• fix(deps): update module sigs.k8s.io/controller-runtime to v0.19.0
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

dockerfile

Dockerfile

• golang 1.23

github-actions

.github/workflows/docker.yaml

• int128/docker-build-workflow v1@c355cd620f7e7bfb34f7ee37cb3adcd3aded8b6c
• actions/checkout v4.1.7@692973e3d937129bcbf40652eb9f2f61becf3332
• actions/setup-go v5.0.2@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32
• docker/metadata-action v5.5.1@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
• int128/wait-for-docker-image-action v1.8.0@4975bd239c55b16ec86bbcca9cab53ac056f8e07

.github/workflows/go.yaml

• int128/kubebuilder-workflows v1@96546ff45434040af88e8a5280e49609d4796ff4

.github/workflows/manifest.yaml

• int128/kubebuilder-workflows v1@96546ff45434040af88e8a5280e49609d4796ff4

.github/workflows/release.yaml

• actions/checkout v4.1.7@692973e3d937129bcbf40652eb9f2f61becf3332

gomod

go.mod

• go 1.22.0
• go 1.23.0
• github.com/envoyproxy/go-control-plane v0.13.0
• github.com/google/go-cmp v0.6.0
• github.com/onsi/ginkgo/v2 v2.20.1
• github.com/onsi/gomega v1.34.1
• google.golang.org/protobuf v1.34.2
• k8s.io/api v0.30.3
• k8s.io/apimachinery v0.30.3
• k8s.io/client-go v0.30.3
• k8s.io/utils v0.0.0-20240821151609-f90d01438635@f90d01438635
• sigs.k8s.io/controller-runtime v0.18.5

regex

.github/renovate.json5

• int128/go-renovate-config v1.4.1
• int128/go-renovate-config v1.4.1
• int128/go-renovate-config v1.4.1
• int128/go-renovate-config v1.4.1

.github/workflows/docker.yaml

• golang-version 1.23.0

.github/workflows/go.yaml

• golang-version 1.23.0

.github/workflows/go.yaml

• golangci/golangci-lint v1.60.3

README.md

• int128/ktunnels v0.8.0

internal/envoy/image.go

• envoyproxy/envoy v1.31.0

---

• Check this box to trigger a request for Renovate to run again on this repository

Action Required: Fix Renovate Configuration

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

Error type: Cannot find preset's package (github>int128/go-actions)