-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
nomad port-forward command #6925
Comments
port-forward but for tooling purposes, we can just deploy util job then exec and play around there, but if you want port-forward for connections to different cluster better deploy envoy or another proxy |
I really wanted this feature this past Sunday after deploying a service with an HTTP API I didn't want to expose to my SSH bastion, or any other networked services within my cluster, or fiddle with additional load balancers, or edge router configs. I found myself using I just wanted to forward the traffic from a local listener on my host to an upstream service available to the task.
So, I went down a fairly deep Nomad-shaped rabbit hole to understand how to make this a reality. Along the way, I learned a lot -- like, how it actually sort'of already exists, and how it could work better in the future. 🕳🐇 Port Forwarding with
|
Just wanted to chip on @picatz awesome existing workaround.
|
Kubernetes has a port-forward command that allows operators to dynamically and ephemerally forward a local port to a remote pod for debugging and other operations.
This feature seems particularly useful when using Consul Connect as Connect's mTLS requirements make it difficult for operators to peek at Connectified services.
Implementation
Port forwarding should use Nomad's existing region-aware RPC infrastructure to allow forwarding ports across regions.
Implementation on the client-side (CNI? driver specific?) is TBD.
Security
A new ACL capability would be added:
namespace:alloc-net
(name TBD). While port forwarding offers a similarly high level of container access asnamespace:alloc-exec
, this feature should have a distinct ACL to avoid having to give operators remote execution privileges.The text was updated successfully, but these errors were encountered: