Kc Proxy
You run a kc proxy to open a local tunnel to your cluster API. This command forwards requests from your machine to the remote control plane. Teams often use this local bridge to test apps and check cluster state. Still, the tunnel uses whatever local credentials sit on the developer laptop. If those credentials hold broad admin roles, every local app gets full cluster control. How a kc proxy routes local traffic A kc proxy acts as a bridge between your desktop and the cluster API. When you st
Database Proxy (ProxySQL, PgBouncer): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You run a kc proxy to open a local tunnel to your cluster API. This command forwards requests from your machine to the remote control plane. Teams often use this local bridge to test apps and check cluster state. Still, the tunnel uses whatever local credentials sit on the developer laptop. If those credentials hold broad admin roles, every local app gets full cluster control.
How a kc proxy routes local traffic
A kc proxy acts as a bridge between your desktop and the cluster API. When you start the tool, it reads your local cluster config file. It finds the target server address and your stored user token or key. Then it binds to a local port on your own machine.
Once the port is open, you can send plain HTTP requests to localhost. You do not need to attach security headers to every single call. The local process adds your TLS certs and bearer tokens on the fly. It sends the request to the remote API and returns the response.
This setup makes local testing fast and simple for engineers. A developer can point a browser or script at the local port. They can read pod logs, check node status, or view service specs. The remote cluster sees every call as coming from that specific authenticated user.
What the native setup solves and where it falls short
The native tool solves the problem of manual token handling during local work. Developers do not have to paste raw keys into browsers or test scripts. It also lets local tools talk to internal services without public load balancers. The cluster RBAC engine still checks the user role at the API boundary.
Yet this workflow leaves a major gap in day-to-day operations. The setup only decides who can open the initial session. It does not inspect individual commands or API calls in flight. Once the tunnel is open, every action runs with the user's full role.
Many teams grant broad roles so engineers can fix urgent bugs fast. Over time, those wide permissions stay active on developer laptops. A careless script or broken local app can delete workloads through the open port. Worse, standard cluster logs only show the broad role, not why the change happened.
Database Proxy (ProxySQL, PgBouncer): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Why static local credentials create risk
Local config files often store long-lived keys or static user tokens. If a laptop gets lost or infected, an attacker can read those files. They can start a local listener and gain full control of the cluster. Revoking those static keys across a large team takes time and causes downtime.
Teams also struggle to audit what happens inside forwarded service traffic. When an engineer forwards traffic to a database pod, the cluster only logs the connection. It does not see the queries or data returned inside that stream. Sensitive data like emails, phone numbers, or card numbers can flow back in plain text.
To reduce risk, teams should move away from static local config files. Tying every command to live identity and reviewing actions in flight keeps systems safe. Masking rules can also rewrite matched fields in results before they reach the screen.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What is the difference between a kc proxy and port forwarding?
A kc proxy talks to the main cluster API server as a whole. Port forwarding sends raw network traffic straight to one specific pod or service.
Is it safe to expose a local cluster tunnel to a network?
No, you should bind the listener only to your local loopback address. Opening the port to a shared network lets anyone use your cluster permissions.
How do I stop an active local cluster tunnel?
You can stop the running process in your terminal window to close the port. If it runs in the background, find the process ID and end it.