[Blog](https://tuna.am/en/blog.md)|[New features](https://tuna.am/en/blog/tags/features)

# Kubernetes tunnel — temporary cluster access with a single link

October 5 · 4 min

Here's a familiar scenario: a contractor needs to check logs in the staging cluster, a colleague from another team needs to help with debugging, and the cluster's API server isn't reachable from the internet. The usual choice is between "set them up with a VPN and an account" and "send them your kubeconfig" — and both options are bad.

We've added a new tunnel type to tuna-cli 0.36: **Kubernetes**. One command, and the guest gets a link to a ready-made kubeconfig that works with plain `kubectl`:

```shell
tuna kubernetes --context=staging --service-account=shop/debug --preset=debug --ttl=4h

```

## How it works

The client reads your local kubeconfig, starts a reverse proxy to the API server and exposes it through an HTTP tunnel with a valid TLS certificate. The guest gets a one-time link:

```shell
curl -sfO https://<tunnel address>/tuna/<secret>/kubeconfig.yaml
KUBECONFIG=./kubeconfig.yaml kubectl get pods

```

The downloaded kubeconfig contains a **guest token**, not your credentials. The proxy checks this token and swaps it for your real credentials, which never leave your machine. Stop the tunnel and access is gone — there's nothing to revoke.

Everything `kubectl` users are used to works through the tunnel: `get`, `list`, `watch`, `logs`, `exec` with stdin, `port-forward`, `pods/proxy` and writes — `scale`, `create`, `delete`. Essentially, it's an auth proxy for the Kubernetes API that starts with a single command and lives exactly as long as you need it.

## You control the guest's permissions

The first line of defense is **RBAC**. By default, the guest acts with your permissions, and the client warns you about it up front. The better way is to create a service account with minimal permissions for the guest and pass it in the `--service-account` flag. The client then issues a token for it via the TokenRequest API and renews it every hour.

The second line is **the tunnel's own restrictions**. They work on top of RBAC and can only narrow permissions:

| Flag                                 | What it does                                                           |
| ------------------------------------ | ---------------------------------------------------------------------- |
| `--namespace=shop`                   | A single namespace only, no cluster-scoped resources and no `-A`       |
| `--read-only`                        | Read-only: no `exec`, `attach` or `port-forward`, but logs are allowed |
| `--no-delete`                        | Everything except deleting                                             |
| `--deny-resource=secrets,configmaps` | Denies specific resources                                              |
| `--deny-subresource=exec,attach`     | Denies subresources                                                    |

Presets save you from combining restrictions by hand:

| Preset     | What is allowed                                                      |
| ---------- | -------------------------------------------------------------------- |
| `view`     | Read-only, no `secrets`, `exec`, `attach`, `port-forward` or `proxy` |
| `observer` | Read-only access to pods and their logs                              |
| `debug`    | Everything except deleting                                           |
| `open`     | No extra restrictions                                                |

Presets and flags add up and never weaken each other: `--preset=debug --read-only` gives read-only access.

## Lifetime and one-time links

* `--ttl=4h` — after four hours, the guest's `kubectl` gets `this access has expired, ask for a new link`.
* `--download-limit` — how many times the kubeconfig can be downloaded, **once** by default. If the guest gets `410` on the very first try, someone else got to the config first: stop the tunnel and issue a new link.

Guest tokens live only in the process memory: after the client restarts, old links stop working.

## Full visibility

The tunnel runs in the new [terminal interface](https://tuna.am/en/docs/tunnels/tui.md): the header shows the service account, namespace, restrictions and access expiry, and below it, a feed of the guest's requests. The same requests show up in the [Request Inspector](https://tuna.am/en/docs/tunnels/http/inspect.md) as regular HTTP requests, so you always know exactly what the guest did in the cluster.

## Who it's for

* **Contractors and outsourced teams** — give them access to staging for the duration of the job, without creating cloud accounts.
* **Support and on-call engineers** — quickly let a colleague in to look at logs and pods in `observer` mode.
* **Demos and training** — show a cluster at a workshop with `--read-only` and a short `--ttl`.
* **Local clusters** — kind, minikube or k3s on your laptop become reachable to a colleague without port forwarding.

If you need a permanent address, use a reserved subdomain (`--subdomain=k8s-staging`) or a custom domain. You can also run the tunnel [as a service](https://tuna.am/en/docs/tunnels/guides/service.md).

The Kubernetes tunnel is available with a [subscription](https://tuna.am/#pricing) starting with **tuna-cli 0.36.0**. The command has a short alias, `tuna k8s`. All flags and details are in the [documentation](https://tuna.am/en/docs/tunnels/kubernetes.md).

## Leave feedback

If you enjoy using Tuna, or on the contrary you are not happy with something, please [leave feedback](https://my.tuna.am/?show_feedback=1).

![](/blog/img/2024-08-22/feedback.gif)

## News

We announce new features and posts on our [Telegram channel](https://t.me/tuna_am). Subscribe so you don't miss anything.

## Help

We value our users and carefully review every request. If you have any problems with tuna, please contact us in one of the following ways:

* [Email](mailto:info@tuna.am)
* [Telegram community](https://telegram.me/+Kgbtt0_gJwI5ZmEy)

Categories: [New features](https://tuna.am/en/blog/tags/features)

[← newer📒 1C tunnel — your infobase on the internet with a single command](https://tuna.am/en/blog/1c-tunnel.md)[older →🎁 Бесплатный тариф без таймера и с постоянным поддоменом](https://tuna.am/en/blog/free-plan-permanent-subdomain.md)