txn2 / kubefwd

Bulk port forwarding Kubernetes services for local development.
https://imti.co/kubernetes-port-forwarding/
Apache License 2.0
3.8k stars 205 forks source link

Option to restart forwarding on TLS connection reset. #262

Open apjoseph opened 1 year ago

apjoseph commented 1 year ago

First off let me say thank you for producing this library, Wish I had discovered it earlier -would have saved me a great many headaches over the years!

Due to a severe bug (kubernetes/kubernetes#111825) affecting kubectl versions>=1.23.6, kubectl port forwarding is currently broken for any service that utilizes TLS. In searching for alternatives to kubectl port forward, I found kubefwd. Unfortunately kubefwd is affected as well since it utilizes the same go client:

←[36mINFO←[0m[18:01:27] Port-Forward:       127.1.27.2 my-pg-svc:5432 to pod ag-1:5432
←[31mERRO←[0m[18:02:23] Runtime: an error occurred forwarding 5432 -> 5432: error forwarding port 5432 to pod 81df427aa522bfa115d0540e697996902eac87d6f67a89ba6866561a9605558b, uid : failed to execute portforward in network namespace "/var/run/netns/cni-5d41cf8f-7a06-167a-b72f-d4c30a123f96": read tcp4 127.0.0.1:34794->127.0.0.1:5432: read: connection reset by peer
←[31mERRO←[0m[18:02:23] Runtime: lost connection to pod
←[33mWARN←[0m[18:02:23] Stopped forwarding pod my-postgres-svc-1 for my-pg-svc.app-dev.microk8s

A succinct description of the cause can be found here. The bug is also the cause of #225

The Kubernetes team has been aware of this critical flaw for nearly a year, but hasn't implemented any fix or even suggested a plausible workaround, -despite it effectively making port-forwarding a non-option for anyone who uses Postgres (or any service) with SSL.

As such, it would be incredibly helpful if kubefwd were to add the ability to reestablish lost connections. It may be an imperfect solution but it would be very useful to Postgres users who currently have to choose between disabling SSL, exposing Postgres directly over the internet, or setting up a VPN.

fundthmcalculus commented 7 months ago

I have autoreconnect functionality (albeit for pod-marked-for-deletion) here: https://github.com/trinsic-id/kubefwd/tree/master I'll see what I can do to get it upstreamed.