kubefwd

Least-privilege permissions

• Use dedicated service accounts – Create a separate kubeconfig file (a configuration file that grants access to your Kubernetes cluster) specifically for kubefwd with only the permissions needed for your development work, not full admin access
• Limit which services can be forwarded – Use role-based access controls (permission rules in Kubernetes) to restrict which applications this tool can access; never use a kubeconfig that grants access to production or sensitive systems
• Rotate credentials regularly – Refresh the kubeconfig file at least monthly, and immediately after any team member with access leaves the organization
• Separate development and production access – Never use the same kubeconfig for kubefwd that you use for managing live production systems

Network isolation

• Use on trusted networks only – Only run kubefwd on laptops or machines connected to your corporate network, never on public Wi-Fi or shared networks
• Enable local firewall rules – Configure your machine's firewall to block access to forwarded ports from other devices on the network; restrict to localhost only (your own machine)
• Keep development machines patched – Regularly update your operating system and all software to prevent attackers from compromising your machine and accessing the forwarded services
• Disable kubefwd when not in use – Stop the tool immediately after development work ends; don't leave it running continuously in the background

Monitoring

• Log all kubefwd sessions – Record when the tool starts, which services are accessed, and by whom; review these logs weekly for unusual activity
• Alert on credential access – Set up notifications if the kubeconfig file is read or copied, especially outside normal development hours
• Track port forwarding activity – Monitor which ports are being used and which cluster services are being accessed through this tool
• Audit cluster API calls – Review Kubernetes audit logs to see what actions were performed through the forwarded services

Red flags to watch for

• Kubeconfig file accessed from unknown locations – If logs show the configuration file being read from a different device or at unusual times
• Forwarding sensitive services – Using kubefwd to access databases, credential storage systems, or payment processing services for local work
• Multiple team members sharing one kubeconfig – Different people using the same credentials increases risk and makes accountability impossible
• Tool left running during off-hours – Forwarded ports remaining open when no active development is happening