Kube Web Proxy
This is a hack to make it easy to connect to HTTP debug interfaces inside your Kubernetes cluster. You go to the proxy, and it shows you a list of pods/services in the cluster. You click the port you want, and it connects you. This makes it easy to access internal debugging interfaces. For example, you can access the Go pprof web UI to collect profiling information. This is a bit like the port-forwarding part of Octant, but runs in your cluster so it doesn't require installing anything, and it is very, very ugly.
Since this is a potential security hole, Kube Web Proxy requires requests to have been authenticated with the Google Cloud Identity-Aware Proxy (IAP). Getting this set up is a bit of a pain. My advice is:
- Set up the Ingress, without IAP turned on. The
/healthendpoint should work, but the other paths will return forbidden errors.
- Enable IAP for the Ingress, which may require some fiddling.
The proxy has to rewrite paths, in order to add
- Managed Certificates on GKE
- IAP on GKE
- GKE Ingress Health checks Verifying IAP headers requires configuring the health check to use a path other than
Set up / using
- Build the container image and publish it.
- Configure IAP for your GKE cluster: https://cloud.google.com/iap/docs/enabling-kubernetes-howto
- Edit kubewebproxy-service.yaml and set
--iapAudienceto the correct values for your cluster.
- kubectl apply -f kubewebproxy-service.yaml to configure the ingress, service, deployment, service account, GKE managed certificates, IAP, etc. This is unlikely to work without some edits.
- Access the ingress in your web browser.
Kubernetes Service Account
This service the
view ClusterRole to read service metadata from the Kubernetes API. I followed the in-cluster configuration example to grant it a service account with permission to view everything:
docker build . --tag=kubewebproxy docker run --rm -ti --publish=127.0.0.1:8080:8080 kubewebproxy
Building with Google Cloud Build
~/google-cloud-sdk/bin/gcloud builds submit . --project=gosignin-demo --substitutions=_LABEL=debug1