K8S port forward to Service in secure cluster

What you need is called RBAC.

Role-based access control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within your organization.

RBAC authorization uses the rbac.authorization.k8s.io API group to drive authorization decisions, allowing you to dynamically configure policies through the Kubernetes API.

RBAC auth rules are configured with K8s resources which can be placed in two groups:

• Role and ClusterRole contains rules that represent a set of permissions, it specify which actions can be performed on which resources, if you want to define a role within a namespace, use a Role, if you want to define a role cluster-wide, use a ClusterRole. More about it here.

• RoleBindings and ClusterRoleBindings binds above role and ClusterRole to specific list of subjects(users,groups,service accounts). A RoleBinding grants permissions within a specific namespace whereas a ClusterRoleBinding grants that access cluster-wide. More about it here.

There is an example Role and RoleBinding for kubectl port-forward from this tutorial.

To take this example even further, let’s say that you want to give a person access to only port-forward. You will have to create an RBAC role that lets this person only do this:

kind: RoleapiVersion: rbac.authorization.k8s.io/v1metadata:  namespace: my-namespace  name: allow-port-forwardrules:- apiGroups: [""]  resources: ["pods", "pods/portforward"]  verbs: ["get", "list", "create"]

This sets up a role in the namespace my-namespace and allows this role to get, list, and create on pods and pods/portforward. These are all of the permissions needed to allow someone to port-forward. This person will be able to list the pods in this namespace.Then you bind this role to a user:

apiVersion: rbac.authorization.k8s.io/v1kind: RoleBindingmetadata:  name: allow-port-forward  namespace: my-namespacesubjects:- kind: User  name: bob  apiGroup: rbac.authorization.k8s.ioroleRef:  kind: Role  name: allow-port-forward  apiGroup: ""

This will give the user bob the rights to perform the above actions in the namespace my-namespace

So the answer here would be to add add rbac auth rules for every user which should be able to use kubectl port-forward.