kubefwd

kubefwd v1.25.17

[!WARNING] Superseded by v1.25.18. Do not install this version. v1.25.17 shipped with known vulnerabilities in golang.org/x/net. Five HTTP/2 advisories are reachable from kubefwd: GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617. It also has unreachable advisories in x/crypto and x/text. v1.25.18 fixes all of them and includes every fix below.

This release fixes three forwarding bugs:

• A goroutine and memory leak on idle forwards across sleep and wake.
• Forwards that kept pointing at the old port or pod after a Service was updated in place.
• Forwards that flapped when the API server interrupted a pod watch.

It also fixes a vulnerability in golang.org/x/text that kubefwd's own code reaches. It moves to the Kubernetes 0.37 client libraries and brings in four months of dependency updates.

The fixes below are all included in v1.25.18. Install v1.25.18 instead.

Bug fixes

Idle forwards no longer leak goroutines and memory (#622, refs #614)

Reported by @avni-ef: memory grew from 74 MB to 1.48 GB over two days on a machine that slept and woke.

kubefwd keeps each forward's connection alive by pinging it every 30 seconds. Stopping the pinger sent a signal that gave up after 100 ms. If a ping was in flight on a connection that died during sleep, which can take up to 30 seconds, the signal was missed. That pinger then kept running against a dead connection forever, and every reconnect added another one.

Now:

• Stopping is reliable. The stop signal is a closed channel, which a pinger sees even when it is busy at that moment, so stopping never times out.
• Pinging stops on every exit path from a forward, including early errors.
• A pinger also ends on its own when its connection closes.
• A pinger never opens a new stream on a connection that is shutting down.

A regression test reproduces the leak against the old code. The approach comes from #619 by @AdamMagued.

The report also shows a second, smaller leak of SPDY connection goroutines. Its root cause is in the Kubernetes streaming library, not in kubefwd. This release makes it less likely to happen, and #614 stays open to track it.

In-place Service updates now rebuild forwards (#617, fixes #615)

Contributed and reported by @idan-rahamim-lendbuzz.

When a Service changed in place, kubefwd kept forwarding to the old target. This happened with a Helm upgrade that moved a port to a sidecar, a changed targetPort, or a changed selector. Before, kubefwd only noticed a change in the number of ports, and even then it resynced from its stale copy of the Service. The only fix was a restart.

Now:

• Port or selector changes: kubefwd compares the Service's ports and selector, stops the affected forwards, waits for their cleanup to finish, and rebuilds them from the new spec. A targetPort change and a selector change that moves the Service to different pods both take effect within about a second.
• Selector removed: the Service's forwards stop.
• Selector added: a Service that previously had no selector, and was skipped, gets forwarded.
• Status-only and metadata-only updates are still ignored.
• TUI: shows a ServiceUpdated event for each rebuild.

Two related fixes come with it. A finishing forward no longer removes a replacement registered under the same key. Pod syncs are serialized, so a rebuild can't interleave with a reconnect or resync.

Tested on a KIND cluster against v1.25.16:

A rebuild can give the Service a new loopback IP. The hostname follows it, but connections open during the rebuild are dropped.

Pod watch interruptions no long

kubefwd v1.25.16

This release modernizes the interactive Terminal UI by moving it onto the Charm v2 library line, hardens API-key startup logging, and rolls up routine dependency and CI maintenance.

Highlights

TUI migrated to Charm v2 (#527, closes #517)

The entire interactive TUI (--tui) has been migrated from the v1 Charm libraries to their v2 equivalents under the charm.land/... module path:

These are distinct, incompatible type systems, so this was a full API migration rather than a version bump. Notable changes handled under the hood:

• View() returns tea.View - alt-screen and mouse capture moved from the removed tea.WithAltScreen() / tea.WithMouseCellMotion() program options to the AltScreen / MouseMode fields on the returned view, applied on every render path.
• Keys - tea.KeyMsg is now an interface; all handlers (services, logs, detail, browse, and help) dispatch on the concrete tea.KeyPressMsg.
• Mouse - tea.MouseMsg split into tea.MouseWheelMsg / tea.MouseClickMsg, with renamed button constants; all wheel-scroll and click-to-focus behavior preserved.
• Styling - lipgloss.Color is now a function returning image/color.Color; viewport sizing moved to SetWidth() / SetHeight() and option-based construction.

No user-facing behavior changes. All keyboard shortcuts (j/k, Enter, Tab, /, r, b, ?, q), traffic metrics, log streaming, theme switching, and auto-reconnect work exactly as before. The dark/light theme workaround was re-validated under lipgloss v2. Verified on ubuntu + macOS with go build, go vet, golangci-lint (0 issues), and the full test suite.

API-key authentication: docs and safer startup logging (#526)

Follow-up to the API-key auth feature (#508):

• Security: the API key is now only printed at startup when kubefwd generated it. A user-supplied KUBEFWD_API_KEY is referenced by name and never echoed to logs.
• Docs: the Authentication sections of openapi.yaml, api-reference.md, and mcp-integration.md were rewritten to cover the Bearer header, KUBEFWD_API_KEY / kubefwd mcp --api-key, the /api/health exemption, and the 401 response.

Dependency updates

• k8s.io/streaming 0.36.1 -> 0.36.2 (#523)
• k8s.io/kubectl 0.36.1 -> 0.36.2 (#525)
• k8s.io/cli-runtime 0.36.1 -> 0.36.2 (#522)
• golang.org/x/sys 0.45.0 -> 0.46.0 (#518)
• github.com/txn2/txeh 1.8.0 -> 1.8.1 (#516)
• github.com/quic-go/quic-go bump (#511)

CI / build

• codecov/codecov-action 6.0.1 -> 7.0.0 (#521)
• github/codeql-action 4.36.0 -> 4.36.1 -> 4.36.2 (#512, #520)
• actions/checkout 6.0.2 -> 6.0.3 (#514)
• docker/setup-qemu-action 4.0.0 -> 4.1.0 (#513)

Install / upgrade

# Homebrew (macOS / Linux)
brew install txn2/tap/kubefwd
brew upgrade kubefwd

# Or download a binary for your platform from the assets below.

Run it (requires root for /etc/hosts and loopback aliases):

sudo -E kubefwd svc -n <namespace> --tui

Full changelog: https://github.com/txn2/kubefwd/compare/v1.25.15...v1.25.16

kubefwd v1.25.15

Highlights

🔒 REST API now requires authentication (security)

The optional REST API (--api) and the HTTP MCP bridge previously served every endpoint — Kubernetes context enumeration, pod log reads, and port-forward creation — with no authentication. Because kubefwd runs as root via sudo -E, any local process could drive it against your kubeconfig. This release adds Bearer-token authentication, addressing advisory GHSA-vwjh-p4vp-9rp2 (#507, #508).

• The API key is resolved from KUBEFWD_API_KEY; if unset, a random 32-character hex key is generated and only its last 4 characters are logged on startup.
• All endpoints require Authorization: Bearer <key> except /api/health, which stays open for liveness probes.
• Token comparison uses crypto/subtle.ConstantTimeCompare to avoid timing side channels.
• kubefwd mcp reads KUBEFWD_API_KEY automatically; a new --api-key flag overrides it.

[!IMPORTANT] Upgrade note: If you use --api or the HTTP MCP bridge, set a known key so automation/CI can authenticate instead of scraping a generated one from logs:

export KUBEFWD_API_KEY=my-known-key
sudo -E kubefwd svc -n my-namespace --api

🐛 Multi-port services recover after a single port is reset (#509)

Fixed an unrecoverable zombie state in which a multi-port service that lost one port's connection — e.g. the TCP RST behavior of kubernetes/kubernetes#111825 — would never re-establish that port or restore its /etc/hosts entries. Auto-reconnect (-a, on by default in --tui) found the pod but did nothing, and only a full kubefwd restart recovered the service.

syncNormalService now reasons in terms of the pod being forwarded rather than a single port: it keeps every port of that pod and re-establishes any that were torn down independently. This also fixes a related regression where a healthy multi-port service could drop all but one port on the periodic resync. (#509, #510)

Dependencies

• golang.org/x/sys → 0.45.0 (#502)
• github.com/modelcontextprotocol/go-sdk → 1.6.1 (#501)

CI / Build

• goreleaser/goreleaser-action → 7.2.2 (#500)
• github/codeql-action → 4.36.0 (#504, #499)
• golangci/golangci-lint-action → 9.2.1 (#506)
• docker/setup-buildx-action → 4.1.0 (#505)
• docker/login-action → 4.2.0 (#503)
• codecov/codecov-action → 6.0.1 (#498)

Full changelog: https://github.com/txn2/kubefwd/compare/v1.25.14...v1.25.15

What's New

MCP Registry Publish Fix (#470)

Fixes the Publish to MCP Registry step in the release workflow that had been failing on every release since v1.25.1. server.json used the snake_case key file_sha256, but the MCP registry schema requires camelCase fileSha256. The workflow now also validates server.json against the official MCP schema (plus an explicit MCPB contract check for fileSha256) before publishing, preventing the class of bug that caused the v1.25.13 homebrew formula SHA drift.

Dependency Updates

Kubernetes

• k8s.io/cli-runtime 0.35.2 → 0.35.3
• k8s.io/kubectl 0.35.2 → 0.35.3

Go Modules

• github.com/moby/spdystream 0.5.0 → 0.5.1 (header-size/count limits, 24-bit frame length enforcement)
• github.com/modelcontextprotocol/go-sdk 1.4.1 → 1.5.0
• golang.org/x/sys 0.42.0 → 0.43.0

CI

• actions/setup-go 6.3.0 → 6.4.0
• actions/upload-artifact 7.0.0 → 7.0.1
• actions/upload-pages-artifact 4.0.0 → 5.0.0
• actions/deploy-pages 4.0.5 → 5.0.0
• docker/login-action 4.0.0 → 4.1.0
• github/codeql-action 4.34.1 → 4.35.1
• sigstore/cosign-installer 4.1.0 → 4.1.1

Docker

• Ubuntu base image digest bump (186072b → 84e77de)

Changelog

• 5eab2dc ci: fix MCP Registry publish step (fileSha256 field name) (#470)
• 8cfcbd9 deps: bump github.com/moby/spdystream from 0.5.0 to 0.5.1 (#460)
• af76b37 ci: bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 (#459)
• 337d352 ci: bump actions/upload-artifact from 7.0.0 to 7.0.1 (#458)
• eaffc2a deps: bump golang.org/x/sys from 0.42.0 to 0.43.0 (#457)
• 0ab9d85 docker: bump ubuntu from 186072b to 84e77de (#456)
• bd6e739 ci: bump docker/login-action from 4.0.0 to 4.1.0 (#455)
• a2469b1 deps: bump github.com/modelcontextprotocol/go-sdk from 1.4.1 to 1.5.0 (#454)
• 1f8cd06 ci: bump CI dependencies (combined) (#453)
• ac6b038 deps: bump k8s.io/cli-runtime and k8s.io/kubectl from 0.35.2 to 0.35.3 (#447)