OpenShift の様々な操作で使用する oc コマンドの port-forward をご紹介します。

port-forward

oc port-forward は SSH Port Forwarding と同様の機能を実現します。

$ oc port-forward --help
Forward one or more local ports to a pod.

 Use resource type/name such as deployment/mydeployment to select a pod. Resource type defaults to 'pod' if omitted.

 If there are multiple pods matching the criteria, a pod will be selected automatically. The forwarding session ends
when the selected pod terminates, and a rerun of the command is needed to resume forwarding.

Examples:
  # Listen on ports 5000 and 6000 locally, forwarding data to/from ports 5000 and 6000 in the pod
  oc port-forward pod/mypod 5000 6000

  # Listen on ports 5000 and 6000 locally, forwarding data to/from ports 5000 and 6000 in a pod selected by the
deployment
  oc port-forward deployment/mydeployment 5000 6000

  # Listen on port 8443 locally, forwarding to the targetPort of the service's port named "https" in a pod selected by
the service
  oc port-forward service/myservice 8443:https

  # Listen on port 8888 locally, forwarding to 5000 in the pod
  oc port-forward pod/mypod 8888:5000

  # Listen on port 8888 on all addresses, forwarding to 5000 in the pod
  oc port-forward --address 0.0.0.0 pod/mypod 8888:5000

  # Listen on port 8888 on localhost and selected IP, forwarding to 5000 in the pod
  oc port-forward --address localhost,10.19.21.23 pod/mypod 8888:5000

  # Listen on a random port locally, forwarding to 5000 in the pod
  oc port-forward pod/mypod :5000

Options:
    --address=[localhost]:
        Addresses to listen on (comma separated). Only accepts IP addresses or localhost as a value. When localhost is
        supplied, kubectl will try to bind on both 127.0.0.1 and ::1 and will fail if neither of these addresses are
        available to bind.

    --pod-running-timeout=1m0s:
        The length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running

Usage:
  oc port-forward TYPE/NAME [options] [LOCAL_PORT:]REMOTE_PORT [...[LOCAL_PORT_N:]REMOTE_PORT_N]

Use "oc options" for a list of global command-line options (applies to all commands).

OCP Image Registry via port-forward

ここでは、OCP Image Registry の確認に使用してみます。

クラスタ外部からの OCP Image Registry へのアクセス状況を curl コマンド等で確認したい場合、OCP Image Registry の設定を変更する必要があります。

oc port-forward を使用する事で、上記の設定を行わずに確認してみます。

OCP Image Registry の Service / Route を確認します。Route が存在しないことから、クラスタ外部からアクセスできないことが分かります。

$ oc project -q
openshift-image-registry

$ oc get svc
NAME                      TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)     AGE
image-registry            ClusterIP   172.30.71.156   <none>        5000/TCP    34d
image-registry-operator   ClusterIP   None            <none>        60000/TCP   34d

$ oc get route
No resources found in openshift-image-registry namespace.

$ oc get configs.imageregistry.operator.openshift.io/cluster -o jsonpath='{.spec.defaultRoute}{"\n"}'

$

oc port-forward を実行します。ここでは localhost:7777 を svc/image-registry:5000 にフォワードしてみます。

$ oc port-forward svc/image-registry 7777:5000 &
[1] 457820
$ Forwarding from 127.0.0.1:7777 -> 5000

ここで oc port-forward は、指定された svc/image-registry から Pod の一覧を取得し、そのうちの1つの Pod に、以下の API で接続します。

Pod Proxy Operations

Create Connect Portforward
connect POST requests to portforward of Pod
HTTP Request
POST /api/v1/namespaces/{namespace}/pods/{name}/portforward

curl コマンドで localhost:7777 経由で OCP Image Registry にアクセスしてみます。

$ curl -I -skL -H "Authorization: Bearer $(oc whoami -t)" https://localhost:7777/v2/
Handling connection for 7777
HTTP/2 200
content-type: application/json
docker-distribution-api-version: registry/2.0
x-registry-supports-signatures: 1
content-length: 2
date: Fri, 22 Nov 2024 03:49:40 GMT

Registry V2 Catalog を取得してみます。

$ curl -skL -H "Authorization: Bearer $(oc whoami -t)" https://localhost:7777/v2/_catalog | jq -r .
Handling connection for 7777
{
  "repositories": [
    "openshift/java",
    "openshift/java-runtime",
～中略～
    "openshift/ubi8-openjdk-11",
    "openshift/ubi8-openjdk-11-runtime",
    "openshift/ubi8-openjdk-17",
    "openshift/ubi8-openjdk-17-runtime",
    "openshift/ubi8-openjdk-21",
    "openshift/ubi8-openjdk-21-runtime",
    "openshift/ubi8-openjdk-8",
    "openshift/ubi8-openjdk-8-runtime"
  ]
}

openshift/ubi8-openjdk-11 の Tag 一覧を取得してみます。

$ curl -skL -H "Authorization: Bearer $(oc whoami -t)" https://localhost:7777/v2/openshift/ubi8-openjdk-11/tags/list | jq -rc .
Handling connection for 7777
{"name":"openshift/ubi8-openjdk-11","tags":["1.10","1.13","1.15","1.18","1.3","1.11","1.12","1.14","1.16","1.17"]}

これは、以下の ImageStream と ImageStreamTag に対応しています。

$ oc get is ubi8-openjdk-11 -n openshift
NAME              IMAGE REPOSITORY                                                             TAGS                                                  UPDATED
ubi8-openjdk-11   image-registry.openshift-image-registry.svc:5000/openshift/ubi8-openjdk-11   1.10,1.11,1.12,1.13,1.14,1.15,1.16,1.17 + 2 more...   4 weeks ago

$ oc get istag -n openshift | grep "^ubi8-openjdk-11:"
ubi8-openjdk-11:1.18              image-registry.openshift-image-registry.svc:5000/openshift/ubi8-openjdk-11@sha256:b85cbdbc289752c91ac7f468cffef916fe9ab01865f3e32cfcc44ccdd633b168              4 weeks ago
ubi8-openjdk-11:1.10              image-registry.openshift-image-registry.svc:5000/openshift/ubi8-openjdk-11@sha256:e851770fd181ef49193111f7afcdbf872ad23f3a8234e0e07a742c4ca2882c3d              4 weeks ago
ubi8-openjdk-11:1.11              image-registry.openshift-image-registry.svc:5000/openshift/ubi8-openjdk-11@sha256:ce5c0becf829aca80734b4caf3ab6b76cb00f7d78f4e39fb136636a764dea7f6              4 weeks ago
ubi8-openjdk-11:1.13              image-registry.openshift-image-registry.svc:5000/openshift/ubi8-openjdk-11@sha256:868224c3b7c309b9e04003af70a5563af8e4c662f0c53f2a7606e0573c9fad85              4 weeks ago
ubi8-openjdk-11:1.15              image-registry.openshift-image-registry.svc:5000/openshift/ubi8-openjdk-11@sha256:9036a59a8275f9c205ef5fc674f38c0495275a1a7912029f9a784406bb00b1f5              4 weeks ago
ubi8-openjdk-11:1.16              image-registry.openshift-image-registry.svc:5000/openshift/ubi8-openjdk-11@sha256:425e2c7c355bea32be238aa2c7bdd363b6ab3709412bdf095efe28a8f6c07d84              4 weeks ago
ubi8-openjdk-11:1.17              image-registry.openshift-image-registry.svc:5000/openshift/ubi8-openjdk-11@sha256:67fee4b64b269f5666a1051d806635b675903ef56d07b7cc019d3d59ff1aa97c              4 weeks ago
ubi8-openjdk-11:1.12              image-registry.openshift-image-registry.svc:5000/openshift/ubi8-openjdk-11@sha256:3f00540ce2a3a01d2a147a7d73825fe78697be213a050bd09edae36266d6bc40              4 weeks ago
ubi8-openjdk-11:1.14              image-registry.openshift-image-registry.svc:5000/openshift/ubi8-openjdk-11@sha256:0669a28577b41bb05c67492ef18a1d48a299ac54d1500df8f9f8f760ce4be24b              4 weeks ago
ubi8-openjdk-11:1.3               image-registry.openshift-image-registry.svc:5000/openshift/ubi8-openjdk-11@sha256:663eb81388ae8f824e7920c272f6d2e2274cf6c140d61416607261cdce9d50e2              4 weeks ago

以上のように、oc port-forward を使用することで設定変更なしで簡単に確認する事ができます。