Kubernetes / Services, DNS & Traffic Routing
Use a localhost-only port-forward as a bounded diagnostic path
A controlled port-forward can test a Pod listener while bypassing parts of normal Service or Ingress routing. It is not a production exposure mechanism.
Environment and inputs: Kubernetes · kubectl with supported client/server versions and delegated RBAC. Examples use namespace app unless noted. Check context, namespace, APIs and provider support first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
kubectl -n app port-forward --address=127.0.0.1 pod/web-0 18080:8080Read the result
This opens a local tunnel while the command runs and requires port-forward authorization. Success bypasses some normal paths and does not prove they work.
Resolve and verify
Use an approved harmless request locally, compare it with the failing normal route and stop the tunnel when finished. Continue diagnosis at the layer that differs.
Before changing production
Do not bind the tunnel publicly, forward sensitive administration ports casually or leave it running as a permanent workaround.