I am running k8s cluster for evaluation purposes inside some vagrant box. I have external kubectl access. I was able to get PostgreSQL helm template running on the cluster. But now let say I want to access it outside of the k8s(or VM actually).

There is a problem that I am not very educated in the niceties of Host to Quest communication in VM not to speak about the k8s stack. By empirical research I have found that turning service to NodePort makes it available outside the k8s. But as I said the installed PostgreSQL service is ClusterIP so I want to access it outside aswell without finding a way to turn it to NodePort. So there is couple of noob questions here

  1. what is difference between kubectl proxy and kubectl port-forward?
  2. what is different when executing kubectl proxy from inside VM running k8s cluster and running the same kubectl command on the host?
  3. what is the usual way to make services available outside of the cluster, when using the cluster just for development?
  4. is this quote true?

    port forwarding is not needed when using private network and accessing guest from host with guest private ip, port forwarding is used to access guest with localhost/ the ports are then forwarded

2 Answers 2

  1. kubectl port-forward forwards connections to a local port to a port on a pod. Compared to kubectl proxy, kubectl port-forward is more generic as it can forward TCP traffic while kubectl proxy can only forward HTTP traffic. Generally speaking, using port forwarding you could get on your ‘localhost’ any services launched in your cluster.


  2. It does not make a lot of sence to run 'kubectl proxy' from inside VM running k8s cluster. Kubectl is your client tool, so stick with it outside of cluster range.

  3. The way you would access production services, for the most part if your service is DB oriented stick with ClusterIP. If you want to externally access some Web/HTTP service expose it as a Load Balancer or an Ingress ( in case u have N of them ). If you want to test the DB you could just run a dummy pod and execute some sql-client commands from there.

  • I guess that running proxy/port-forward in the box will enable access to the cluster on the guest machine, which should be visible in the host.This is why I am asking where to run the command. My current VM setting seems to propagate all ports to host. I'm using one-node cluster to run some apps, but I need to connect to the DB pod with some UI tool(it is more efficient for me). I will check possibilities how to run Ingress/LoadBalancer in my cluster.
    – Zveratko
    Mar 9, 2020 at 9:21
  • For me the cleanest way is to explicitly use kubectl and set up kubeconfig, all those hacks are temporary solutions that soon or later might fail. Also you might benefit for authentication over multiple clusters if needed.
    – Recoba20
    Mar 9, 2020 at 9:31
  • I have of course "host" kubectl. I was just suprised that I can actually use it in the guest and has been wondering what it does exactly. So to wrap up - I will run a pod with DB, run kubectl proxy from host and done. I have had some issues and I suspected PostgreSQL to be limited to localhost, but fortunatelly I have been proven otherwise in the Helm chart page.
    – Zveratko
    Mar 9, 2020 at 10:25

To access Kubernetes you typically use port-forward, like this (take from KubeApps)

$ kubectl port-forward -n kubeapps svc/kubeapps 8080:80
Forwarding from -> 8080
Forwarding from [::1]:8080 -> 8080

If you want to make it public so your port-forward listens to all ip addresses, you can use --address as documented in kubectl port-forward --help,

$ kubectl port-forward -n kubeapps svc/kubeapps 8080:80 --address
Forwarding from -> 8080

Now your host is redirecting traffic from 8080 to inside the Kubernetes cluster.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.