kubectl port-forward External Services using TCP Proxy in Kubernetes

Synopsis

It is common that some of your Workloads connect to external services such as databases that run outside your Kubernetes Cluster. These external services are usually secured and deployed in a private subnet.

My team currently uses Google Kubernetes Engine and we use GCP Memorystore (Redis as a Service) for caching. For us to access Memorystore securely, we will have to provision a VM that will act as a bastion host but we found a better approach to deal with this.

Port-forwarding with TCP Proxy

All our services run in Kubernetes, and as much as possible we want to stick with the kubectl everything workflow when dealing with our services. All thanks to tecnativa/tcp-proxy, it makes TCP proxying really easy with Docker.

So basically, any external services that our Kubernetes Cluster can access can also be accessed locally by deploying this sucker.

WARNING: This can be a security flaw in your case, but not for us.

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:
    app: redis-proxy
  name: redis-proxy
  namespace: default
spec:
  selector:
    matchLabels:
      app: redis-proxy
  template:
    metadata:
      labels:
        app: redis-proxy
    spec:
      containers:
      - image: tecnativa/tcp-proxy:latest
        imagePullPolicy: Always
        env:
          - name: LISTEN
            value: ":6379" # The listen address that it will be exposed to.
          - name: TALK
            value: "10.1.1.5:6379" # Private address of Memorystore.
        name: redis-proxy
        resources:
          requests:
            cpu: 10m
            memory: 10m
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      securityContext: {}

With the tcp-proxy deployed, we can now just port-forward the tcp-proxy Pod.

kubectl port-forward redis-proxy 6379:6379

And access Memorystore locally using redis-cli.

redis-cli -p 6379