Kuberbetes Proxy
You set up a kuberbetes proxy by running a local forwarder for your cluster API. This tool reads your local config file and sends your requests to the control plane. Many teams use this method so engineers can check pods from their laptops. Still, local config files often hold broad roles that give users too much power. When an engineer has wide cluster permissions, one bad command can break live apps. How a native kuberbetes proxy works in your cluster The native cluster client includes a bu
Database Proxy (ProxySQL, PgBouncer): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up a kuberbetes proxy by running a local forwarder for your cluster API. This tool reads your local config file and sends your requests to the control plane. Many teams use this method so engineers can check pods from their laptops. Still, local config files often hold broad roles that give users too much power. When an engineer has wide cluster permissions, one bad command can break live apps.
How a native kuberbetes proxy works in your cluster
The native cluster client includes a built-in forwarding mode for local work. When you start it, the tool opens a port on your own machine. It reads your local cluster keys and sets up a secure link to the API. Your local apps or browser can now send standard requests to that local port. The local tool wraps each request with your user keys and sends it out.
On the other side, the cluster API server receives the traffic from your machine. It checks your user certificate or token to verify who you are. Next, the server checks role rules to see if your user can run that action. If the role allows it, the control plane runs the request and returns the data. This workflow lets you reach private cluster services without opening public network ports.
Managing role permissions for local cluster traffic
To keep this setup safe, admins must build strict role rules inside the cluster. You assign each engineer to a group and bind that group to a specific role. A basic role might only allow a user to read pod logs in one namespace. A broader role might let a lead engineer restart broken apps or edit config maps.
Teams often struggle to keep these role rules tight during fast incidents. When a live app fails at night, an engineer needs quick access to fix it. Admins often grant cluster admin roles just to get past permission errors fast. Those broad roles stay on the user account long after the incident ends. Soon, many laptops hold static keys that can delete whole namespaces by mistake.
Database Proxy (ProxySQL, PgBouncer): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native cluster forwarding solves and what it misses
The native forwarding tool solves the basic network problem of reaching a private API server. It handles encryption and attaches your local user keys to every single request. You do not need to expose internal cluster services to the public internet. Combined with role rules, it controls who can log in and reach the cluster.
Still, this native setup leaves a major gap during daily work. Role rules only check if a user can open a shell or read a resource. They do not inspect the actual commands an engineer types inside an interactive pod shell. They also cannot rewrite sensitive data like emails or card numbers in log outputs. Once the session starts, the cluster cannot stop a risky command in flight.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
What is the difference between local port forwarding and API forwarding?
API forwarding sends traffic to the main cluster control plane for management tasks. Port forwarding sends network traffic straight to a single pod port for testing an app.
Does the local cluster forwarder work without a config file?
No, the tool needs a valid local config file with your cluster address and keys. Without those keys, the cluster API server will reject every request you send.
Can native cluster roles block specific shell commands inside a pod?
No, native roles only decide if a user has permission to start a pod shell. Once the shell opens, the cluster does not filter which commands the user runs.