Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Option to restart forwarding on TLS connection reset. #262

Open
apjoseph opened this issue Jun 7, 2023 · 1 comment
Open

Option to restart forwarding on TLS connection reset. #262

apjoseph opened this issue Jun 7, 2023 · 1 comment

Comments

@apjoseph
Copy link

apjoseph commented Jun 7, 2023

First off let me say thank you for producing this library, Wish I had discovered it earlier -would have saved me a great many headaches over the years!

Due to a severe bug (kubernetes/kubernetes#111825) affecting kubectl versions>=1.23.6, kubectl port forwarding is currently broken for any service that utilizes TLS. In searching for alternatives to kubectl port forward, I found kubefwd. Unfortunately kubefwd is affected as well since it utilizes the same go client:

←[36mINFO←[0m[18:01:27] Port-Forward:       127.1.27.2 my-pg-svc:5432 to pod ag-1:5432
←[31mERRO←[0m[18:02:23] Runtime: an error occurred forwarding 5432 -> 5432: error forwarding port 5432 to pod 81df427aa522bfa115d0540e697996902eac87d6f67a89ba6866561a9605558b, uid : failed to execute portforward in network namespace "/var/run/netns/cni-5d41cf8f-7a06-167a-b72f-d4c30a123f96": read tcp4 127.0.0.1:34794->127.0.0.1:5432: read: connection reset by peer
←[31mERRO←[0m[18:02:23] Runtime: lost connection to pod
←[33mWARN←[0m[18:02:23] Stopped forwarding pod my-postgres-svc-1 for my-pg-svc.app-dev.microk8s

A succinct description of the cause can be found here. The bug is also the cause of #225

The Kubernetes team has been aware of this critical flaw for nearly a year, but hasn't implemented any fix or even suggested a plausible workaround, -despite it effectively making port-forwarding a non-option for anyone who uses Postgres (or any service) with SSL.

As such, it would be incredibly helpful if kubefwd were to add the ability to reestablish lost connections. It may be an imperfect solution but it would be very useful to Postgres users who currently have to choose between disabling SSL, exposing Postgres directly over the internet, or setting up a VPN.

@fundthmcalculus
Copy link
Contributor

I have autoreconnect functionality (albeit for pod-marked-for-deletion) here: https://github.com/trinsic-id/kubefwd/tree/master I'll see what I can do to get it upstreamed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants