Tunnelling via pod

Question

I have multiple Kubernetes pods running on a server. One of the pods contains a database application that only accepts connections from a specific subnet (i.e. other Kubernetes pods).

I'm trying to connect to the DB application from the server itself, but the connection is refused because the server's IP is not part of the allowed subnet.

Is there a way to create a simple pod that accepts connections from the server and forwards them to the pod containing the DB app?

Unfortunately, the DB app cannot be reconfigured to accept other connections.

Thank you

Answer 1

The easiest solution is probably to add another container to your pod running socat or something similar and make it listen and connect to your local pod's IP (important: connect to the pod ip, not 127.0.0.1 if your database program is configured to only accept connections from the overlay network). Then modify the service you have for these pods and add the extra port.

The example below assumes port 2000 is running your program and 2001 will be the port that is forwarded to 2000 inside the pod.

Example (the example is running netcat simulating your database program):

apiVersion: v1
kind: Pod
metadata:
  name: database
  labels:
    app: database
spec:
  containers:
  - name: alpine
    image: alpine
    command: ["nc","-v","-n","-l","-p","2000"]
    ports:
    - containerPort: 2000
  - name: socat
    image: toughiq/socat
    ports:
    - containerPort: 2001
    env:
    - name: LISTEN_PROTO
      value: "TCP4"
    - name: LISTEN_PORT
      value: "2001"
    - name: TARGET_PROTO
      value: "TCP4"
    - name: TARGET_HOST
      valueFrom:
        fieldRef:
          fieldPath: status.podIP
    - name: TARGET_PORT
      value: "2000"
---
apiVersion: v1
kind: Service
metadata:
  name: database
spec:
  selector:
    app: database
  ports:
  - name: myport
    port: 2000
    targetPort: 2000
    protocol: TCP
  - name: socat
    port: 2001
    targetPort: 2001
    protocol: TCP
  externalIPs: [xxxxxx]