Awesome Open Source
Awesome Open Source


Build status Latest release Go version License

What is Kubetap?

Kubetap is a kubectl plugin that enables an operator to easily deploy intercepting proxies for Kubernetes Services.

Here is a video presentation and demo of the project.

A short demo of using Kubetap to proxy Harbor is shown below:


Why Kubetap?

Kubetap arose from a need to quickly and efficiently proxy Kubernetes Services without imposing a CNI mandate.

It has always been possible to manually: add a sidecar to Deployment manifests, patch Service manifests, add a mitmweb Service, deploy, test, code push the bugfix, remove the sidecar from the Deployment, un-patch the Service, remove the mitmweb Service, deploy, and test again....

Or, if you own the app, could build and push some Printf debugging... then wait for CI... then track down the pod to get logs...

But both of those are long, laborious processes that are ripe for automation. Thus, Kubetap was born.


The documentation website,, contains formatted documentation. The documentation site source is available in the docs folder, however an abridged documentation is provided below.


From Source

The recommended installation method is to clone the repository and run:

$ go generate

$ go install ./cmd/kubectl-tap


Soluble provides a homebrew formula repository.

brew tap soluble-ai/homebrew-kubetap

brew install kubetap

Binary Release

Binary releases for Mac (non-notarized), Windows, and Linux of varying architectures are available from the Releases page.

With Krew

Kubetap can be installed with krew:

kubectl krew install tap


Kubetap's binary is kubectl-tap. This makes kubetap a kubectl plugin, allowing it to be invoked as kubectl tap.

Kubetap inherits many configuration options from kubectl, such as: --context, --namespace (or -n), --as, etc.

Tap On

Deploy a MITMproxy container to tap the target Service, in the case of this example, the grafana Service's exposed port 443, which uses HTTPS. This uses the --browser flag (which implies --port-forward) to automatically open the proxy and target Service in a browser window.

$ kubectl tap on grafana -p443 --https --browser
Establishing port-forward tunnels to service...


  mitmproxy -
  grafana -

Tap Off

Remove the tap from the grafana Service.

$ kubectl tap off grafana
Untapped Service "grafana"

List Active Taps

The namespaces can be constrained with -n, but by default it lists taps in all namespaces:

$ kubectl tap list
Tapped Namespace/Service:


In a container

It is possible to schedule kubetap as a Pod in Kubernetes using the container. When run in a cluster, kubetap will automatically detect and use serviceaccount tokens that are mounted to the container's filesystem.

Additionally, it is possible to run the containers from a developer laptop as follows:

docker run -v "${HOME}/.kube/:/.kube/:ro" '' on -p80 myservice
docker run -v "${HOME}/.kube/:.kube/:ro" '' off myservice

Made by

This project was created to compliment the Soluble platform.

Building Kubetap is a blog post detailing the creation and implementation of kubetap.

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
go (14,157
kubernetes (1,609
proxy (508
kubectl (76
kubectl-plugins (26
mitmproxy (20

Find Open Source By Browsing 7,000 Topics Across 59 Categories