kubectl-exec-forward

kubectl-exec-forward

A kubectl plugin to run exec commands exposed on Kubernetes pod annotations during a port-forward action lifecycle.

Install

brew install takescoop/formulas/kubectl-exec-forward

Usage

kubectl exec-forward type/name port [flags] [-- command]

Flags

In addition to the standard kubectl flags, the following flags are available for the plugin

Command

The main command can be customized by passing additional arguments to the CLI. The arguments for the original command are supplied to the passed override.

kubectl exec-forward type/name port -- psql -c 'select * from foo limit 1;'

Administration

Administrators can store complex behavior in Kubernetes pod annotations, allowing users to run a single kubectl command to interact with remote resources.

Lifecycle

Annotations

Command

The command object represents an exec command and associated configuration to be executed by the plugin during the port-forwarding lifecycle.

Exec commands are rendered via Go templates using inputs from the CLI, the args annotation, configuration from the port-forwarding connection and previous command outputs.

In addition to the following, all standard Go templating functions are available for use

Examples

Connect to an AWS RDS database using a generated password. socat is used to forward connections from the pod to the remote RDS database.

kind: Pod
metadata:
  name: db
  annotations:
    exec-forward.pod.kubernetes.io/args: '{"username":"read"}'
    exec-forward.pod.kubernetes.io/pre-connect: |
      [{
        "command": [
          "aws",
          "rds",
          "generate-db-auth-token",
          "--host",
          "...rds.amazonaws.com",
          "--port",
          "5432",
          "--username",
          "{{.Args.username}}"
        ],
        "id": "password",
        "name": "Generate temporary password"
      }]'
    exec-forward.pod.kubernetes.io/command: |
      {
        "command":[
          "psql",
          "postgres://{{.Args.username}}:{{ trim .Outputs.password.Stdout | urlquery | sensitive }}@localhost:{{.Config.LocalPort}}/db"
        ]
      }
spec:
  containers:
    image: alpine/socat
    - command:
      - socat
      - tcp-listen:5432,fork,reuseaddr
      - tcp-connect:...rds.amazonaws.com:5432
      ports:
        name: postgres

kubectl exec-forward pod/db postgres

Request data through a forwarded connection using a token generated

kind: Deployment
metadata:
  name: foo
...
spec:
  template:
    metadata:
      annotations:
        exec-forward.pod.kubernetes.io/pre-connect: |
          [{
            "command": [
              "curl",
              "-d",
              "user=user&pass={{.Args.password}}",
              "https://example.com/token"
            ],
            "name": "Generate token",
            "id": token"
          }]
        exec-forward.pod.kubernetes.io/command: |
          {
            "command": [
              "curl",
              "-H",
              "X-Auth-Token: {{.Outputs.token.Stdout}}",
              "localhost:{{.Config.LocalPort}}/data"
            ]
          }
      spec:
        containers:
          ...
          - ports:
              name: http
              ...

kubectl exec-forward deployment/foo http