Kubetap is a kubectl plugin that enables an operator to easily deploy intercepting proxies for Kubernetes Services.
Here is a video presentation and demo of the project.
A short demo of using Kubetap to proxy Harbor is shown below:
Kubetap arose from a need to quickly and efficiently proxy Kubernetes Services without imposing a CNI mandate.
It has always been possible to manually: add a sidecar to Deployment manifests, patch Service manifests, add a mitmweb Service, deploy, test, code push the bugfix, remove the sidecar from the Deployment, un-patch the Service, remove the mitmweb Service, deploy, and test again....
Or, if you own the app, could build and push some Printf debugging... then wait for CI... then track down the pod to get logs...
But both of those are long, laborious processes that are ripe for automation. Thus, Kubetap was born.
The documentation website, https://soluble-ai.github.io/kubetap/, contains formatted documentation. The documentation site source is available in the docs folder, however an abridged documentation is provided below.
The recommended installation method is to clone the repository and run:
$ go generate
$ go install ./cmd/kubectl-tapSoluble provides a homebrew formula repository.
brew tap soluble-ai/homebrew-kubetap
brew install kubetapBinary releases for Mac (non-notarized), Windows, and Linux of varying architectures are available from the Releases page.
Kubetap can be installed with krew:
kubectl krew install tapKubetap's binary is kubectl-tap. This makes kubetap a kubectl plugin,
allowing it to be invoked as kubectl tap.
Kubetap inherits many configuration options from kubectl, such as: --context,
--namespace (or -n), --as, etc.
Deploy a MITMproxy container to tap the target Service, in the case of this example,
the grafana Service's exposed port 443, which uses HTTPS. This uses the
--browser flag (which implies --port-forward) to automatically open the
proxy and target Service in a browser window.
$ kubectl tap on grafana -p443 --https --browser
Establishing port-forward tunnels to service...
Port-Forwards:
mitmproxy - http://127.0.0.1:2244
grafana - https://127.0.0.1:4000
Remove the tap from the grafana Service.
$ kubectl tap off grafana
Untapped Service "grafana"The namespaces can be constrained with -n, but by default it lists taps in
all namespaces:
$ kubectl tap list
Tapped Namespace/Service:
default/grafanaIt is possible to schedule kubetap as a Pod in Kubernetes using the
grc.io/soluble-oss/kubectl-tap:latest container. When run in a cluster,
kubetap will automatically detect and use serviceaccount tokens that are
mounted to the container's filesystem.
Additionally, it is possible to run the containers from a developer laptop as follows:
docker run -v "${HOME}/.kube/:/.kube/:ro" 'gcr.io/soluble-oss/kubectl-tap:latest' on -p80 myservicedocker run -v "${HOME}/.kube/:.kube/:ro" 'gcr.io/soluble-oss/kubectl-tap:latest' off myserviceThis project was created to compliment the Soluble platform.
Building Kubetap is a blog post detailing the creation and implementation of kubetap.