<p>I couldn't find any information on wherever a connection creation between cluster's pod and locahost is encrypted when running "kubectl port-forward" command.</p>

<p>It seems like it uses "<a href="https://linux.die.net/man/1/socat" rel="noreferrer">socat</a>" library which supports encryption, but I'm not sure if kubernetes actually uses it.</p>

<p>kubectl port-forward uses socat to make an encrypted TLS tunnel with port forwarding capabilities. 
The tunnel goes from you to the kube api-server to the pod so it may actually be 2 tunnels with the kube api-server acting as a pseudo router. </p>

<p>An example of where I've found it useful was that I was doing a quick PoC of a Jenkins Pipeline hosted on Azure Kubernetes Service and earlier in my Kubernetes studies I didn't know how to setup an Ingress, but I could reach the Server via port 80 unencrypted, but I knew my traffic could be snooped on. So I just did kubectl port-forward to temporarily login and securely to debug my POC. Also really helpful with RabbitMQ Cluster hosted on Kubernetes, you can go into the management webpage with kubectl port-forward and make sure that it's clustering the way you wanted it to. </p>
