K9s View Services
To use k9s view services, open the terminal tool and enter the service command. This screen lists all active network routes, ports, and load balancers in your cluster. Many teams use this view to check app traffic during an outage. They often share broad cluster roles so engineers can fix broken network paths fast. Broad roles let users change live routes or open local ports without oversight. How k9s view services works in your cluster The terminal tool reads your local cluster file to log i
Database View-Based Access Control: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To use k9s view services, open the terminal tool and enter the service command. This screen lists all active network routes, ports, and load balancers in your cluster. Many teams use this view to check app traffic during an outage. They often share broad cluster roles so engineers can fix broken network paths fast. Broad roles let users change live routes or open local ports without oversight.
How k9s view services works in your cluster
The terminal tool reads your local cluster file to log in to the server. It uses your current user role to ask the control plane for service data. The server checks your role rules before it sends back the network list. Once approved, the tool renders a live table of services in your chosen namespace. You can filter this table by name or label to find specific apps.
From this screen, you can inspect the endpoints tied to each network service. Endpoints show which pod IP addresses receive traffic from the service route. If a service has no endpoints, the label selector might not match any pods. You can also jump straight from a service row to its linked pods. This flow helps engineers trace failed requests from the network edge to the pod.
The service view also lets users forward local ports to remote cluster services. Port forwarding creates a direct tunnel from the user laptop to the cluster network. Engineers use this tunnel to test internal apps that have no public address. The tool keeps this tunnel open as long as the terminal session runs.
What native cluster roles solve and what they miss
Native cluster roles control who can read, edit, or delete service objects. You can set up a read role so junior staff only view network tables. You can give senior engineers an edit role so they can fix broken selectors. These roles stop unauthorized users from viewing or breaking cluster routes at the API level.
Still, static roles only check permissions when a session or request starts. They do not inspect what happens inside a port forward tunnel once it opens. If a role allows port forwarding, the user can reach any internal database service. They can run queries or pull sensitive records like emails and card numbers. Native logs only show that a tunnel opened, not what data moved through it.
Database View-Based Access Control: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Managing live actions during service checks
When engineers fix live services, they often need to edit routes or check pods. Giving them permanent edit roles leaves the cluster open to mistakes all day. A single wrong key press in the terminal UI can delete a production service. Teams need a way to approve high-risk actions one command at a time.
Instead of broad static files, teams should tie cluster actions to real user identities. Every view, edit, or port tunnel should link back to a single person. Sensitive fields like phone numbers or national IDs should be masked in results. This approach lets engineers check service health while keeping live data safe.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Why is my service list empty in the terminal view?
You might be looking at the wrong namespace in your current view. Switch to the all namespaces view or check if your role allows reading services.
How do I check if a service routes traffic to pods?
Select the service row in the table to view its linked endpoint objects. If the endpoint list shows active pod addresses, the route is working as expected.
Can I stop users from opening port tunnels in the service view?
Yes, you can remove the port forward rule from their cluster role definition. Without that specific rule, the cluster API will block any tunnel request they send.