<p>Is there any way to access the 'internal' services (those not exposed outside) of the cluster in a secure way from the outside.</p>

<p>The goal is simple: I need to debug clients of those services and need to access them, but don't want to expose them outside.</p>

<p>On a regular single host I would normally tunnel to the host with SSH and map the ports to localhost; I tried using a SSHD container but that didn't get me very far: the services are not directly on that container so I'm not sure how to get to the next hop on the network since the services are dynamically managing IPs.</p>

<p>Ideally a VPN would be much more convenient, but GKE doesn't seem to support VPN for road warrior situation.</p>

<p>Is there any solution for this use-case?</p>

<p>Thanks for your input.</p>

<p>EDIT:</p>

<p>I see here:
<a href="https://github.com/kubernetes/kubernetes/blob/master/docs/user-guide/accessing-the-cluster.md#ways-to-connect" rel="noreferrer">https://github.com/kubernetes/kubernetes/blob/master/docs/user-guide/accessing-the-cluster.md#ways-to-connect</a></p>

<p>that the only way to connect supported right now is HTTP/HTTPS meaning I can proxy HTTP calls but not to any port</p>

<p>You can do this with a combination of running <code>kubectl proxy</code> on your dev machine and using the proxying functionality built into the master (that's a lot of proxying, but bear with me). </p>

<p>First, run <code>kubectl proxy</code>. Note the port that is bound locally (it should be 8001 by default). This will cause kubectl to create a tunnel to your master instance that you can hit locally without needing to pass any authentication (technically, you can do all of the following steps without doing this first by hitting the master directly, but this is simpler for debugging).</p>

<p>Next, point a client (web browser, curl, etc) at <code>http://localhost:8001/api/v1/proxy/namespaces/&lt;ns&gt;/services/&lt;svc&gt;/</code>, replacing <code>&lt;ns&gt;</code> with the namespace in which your service is configured and <code>&lt;svc&gt;</code> with the name of your service. You can also append a particular request path to the end of the URL, so if your pods behind the service are hosting a file called <code>data.json</code> you would append that to the end of the request path. </p>

<p>This is how the <a href="https://github.com/kubernetes/kubernetes/tree/master/docs/user-guide/update-demo" rel="nofollow">update-demo</a> tutorial works, so if you get stuck I'd recommend walking through that example and taking a close look at what the <a href="https://github.com/kubernetes/kubernetes/blob/master/docs/user-guide/update-demo/local/script.js" rel="nofollow">javascript</a> does (it isn't too complicated). </p>
