Port forwards

KubeGlass forwards a port on your computer to a pod or a Service, the way kubectl port-forward does, from a resource list or from the object’s page. Clusters › Port forwards lists the forwards that run, each with a link that opens it in the browser. Port forwarding works when KubeGlass runs on your own computer; see When port forwarding is off.

Forward a port of a pod

1. Open Resources › Workloads › Pods, select the pod’s row and press Shift F, or choose Forward a port in the row’s menu. On the pod’s page, use Port forward.
2. Under Remote port, pick one of the ports the pod’s containers declare, or type one if they declare none.
3. Keep the Local port KubeGlass suggests, or type another.
4. Press Start forwarding, or Enter in Local port.

A notification then says “Forwarding localhost:8080 to web-0:8080”, and its Open button opens http://localhost:8080 in a new tab.

Forward a port of a Service

1. Open Resources › Network › Services, select the Service’s row and press Shift F, or use Port forward on the Service’s page.
2. Under Remote port, pick one of the Service’s ports.
3. Keep or change the Local port, and press Start forwarding.

KubeGlass picks a pod behind the Service as kubectl port-forward svc/<name> does: one whose labels match the Service’s selector and that is running, ready and not being deleted. The forward goes to the port the Service port sends traffic to, its targetPort by number or by the container port’s name. A Service without a selector, or without a ready pod, can’t be forwarded to, and KubeGlass says why. The forward stays on the pod it picked; it doesn’t spread connections over the Service’s pods. When that pod goes away, as in a rollout, the forward goes on through another ready pod behind the Service on the same local port, and the list says “moved to <pod> 2m ago”. It looks for one for 30 seconds (“Finding another pod”) and ends when none is ready by then. kubectl port-forward svc/ ends there.

A workload’s pod

Shift F on a Deployment, StatefulSet, DaemonSet or ReplicaSet forwards to one of its pods: the oldest that is running, ready and not being deleted. The dialog opens for that pod, with the ports of the workload’s pod template. A workload with no ready pod says so: “Deployment web has no ready pod to forward to”. Workload pages have no Port forward button.

Shift F isn’t offered on a pod that succeeded or failed, or on a row of another cluster in a list that shows several clusters; switch to that cluster first.

The dialog

• Remote port lists each port with its name and protocol, such as 8080 (http) / TCP.
• Local port starts at the same number as the remote port. For a remote port below 1024 it starts 8000 higher (8080 for 80), because the low ports need admin rights on most computers, and the dialog says so. A port another forward already uses is skipped for the next one up.
• If your computer won’t open the local port, the dialog says why under Local port as soon as you start the forward: “Port 3000 is already in use on this computer. Pick another local port.”, or for a low port, “Port 80 needs admin rights on this computer. Use 8080 or another port from 1024 up.”
• Active forwards lists the object’s running forwards, each with Open in browser, Copy URL and Stop forwarding. All port forwards opens Clusters › Port forwards.

Clusters › Port forwards

The list shows the forwards you started, with these columns:

Column	Shows
Local address	localhost:<port>, which opens the forward in a new tab, and a button that copies its URL
Target	Pod or Service, its name and port, linking to it. Under it: the namespace, the cluster for forwards started in this browser, and for a Service the pod it goes through (“through pod web-7d9f4-x2kq:8080”)
Status	Active, with how long until it closes (“closes in 11h”) or when it moved to another pod, or Ended, with how long ago and why: “Pod <pod> went away.”, “No other pod of <service> was ready to take over.”, “Closed after 12 hours.” or “The connection to pod <pod> broke.” Hover the reason for what the cluster said
Started	How long ago it started
Actions	Restart and Stop for a running forward; Start again and Remove for one that ended

Restart stops a forward and starts it again on the same local port; for a Service it picks a ready pod again. Stop ends it, and with more than one running, Stop all ends them all. The filter matches the local address, target, pod, namespace and cluster.

Forwards run on the KubeGlass server, so they outlive a page reload, and the list asks the server for them every 15 seconds. You see the forwards you started; a KubeGlass admin sees and can stop everyone’s.

A forward that ends without anyone stopping it, because its pod went away, the 12 hours passed or KubeGlass restarted, stays in this browser’s list as Ended for a day, the latest 20 at most. Start again starts it on the same local port; Remove forgets it. Start again and Restart work on the current cluster: for a forward from another cluster they say “Switch to <cluster> to start this forward”, and on a cluster marked read-only, “This cluster is read-only”.

While any forward runs, the top bar shows how many on a wide screen, such as “2 forwards”. Its menu lists each one (localhost:8080 → shop/web:80) with Open in browser and Stop forwarding, then All port forwards. :pf in the command palette (or :portforward) opens Clusters › Port forwards too.

How a forward works

KubeGlass opens the forward from the computer it runs on, through the API server’s pods/portforward subresource, as you. That takes create on pods/portforward in the pod’s namespace, and for a Service, get on the Service and list on pods. When RBAC refuses, KubeGlass says “Your Kubernetes permissions don’t allow port forwarding to pod <pod>.”

• The forward listens on localhost (127.0.0.1 and ::1) of that computer, so other computers on your network can’t reach it.
• The pod has 10 seconds to accept the forward; after that KubeGlass gives up and says so.
• A forward closes after 12 hours, and when KubeGlass stops.
• One KubeGlass runs at most 50 forwards at once, for all its users together.
• Starting a forward is recorded in the audit log as Port forward (port_forward in the API).

When port forwarding is off

KubeGlass offers no port forwards, and Clusters › Port forwards, :pf, Shift F and Port forward aren’t there, when:

• KubeGlass runs in a cluster. A port it opened would listen in KubeGlass’s own pod, where your browser can’t reach it, so the server refuses with “Port forwarding works only when KubeGlass runs on your machine. Use kubectl port-forward instead.” Run kubectl port-forward on your computer.
• KubeGlass runs in read-only mode (--read-only), which turns port forwarding off along with every change.

On a cluster you marked read-only, lists don’t offer Shift F, and the server refuses new forwards to that cluster.

Related

Clusters

Overview and resources

Running for a team