kubectl port-forward and proxy
`kubectl port-forward` tunnels a local port to something in the cluster through the API server, which means it works on any Service, needs no NodePort and no Ingress, and reaches things that are not exposed at all. This shows it against a Service, a Pod and a Deployment, adds `kubectl proxy` for the API itself, and contrasts all of it with a NodePort.
Services and Networking Guide 38 of 44 Beginner
- Kubernetes1.36.4
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 14 min
- Reviewed23 August 2026
Written against the versions above. A forward to `svc/name` resolves the Service to ONE of its Pods and tunnels to that Pod for the lifetime of the connection. It does not load-balance, and if that Pod is deleted the forward dies rather than moving - which is why a forward that stops working during a rollout is expected behaviour.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- kubectl with access to the cluster. No cluster changes are needed for the forwarding part.
- The session creates namespace
ckad-fwd, a two-replica Deployment behind a ClusterIP Service, and starts and stops four forwards.
-
Something to reach
-
port-forward to a Service
-
To a Pod, and to a Deployment
-
The API itself, through a proxy
-
What port-forward is not