<ol>
<li>In <code>kubernetes</code> I can expose services with <code>service</code>.  This is fine.</li>
<li>Lets say I have 1 web instance and 10 java server instances.</li>
<li>I have a windows gateway I'm used to access those 10 java servers instances via the jconsole installed on it.</li>
<li>Obviously I do not expose all apps jmx port via kubernetes service.</li>
</ol>

<p>What are my options here? how should I allow this external to kubernetes cluster windows gateway access to those 10 servers jmx ports? Any practices here?</p>

<p>Another option is to forward JMX port from K8 pod to your local PC with <strong>kubectl port-forward</strong>. </p>

<p>I do it like this:</p>

<p>1). Add following JVM options to your app:</p>

<pre><code>-Dcom.sun.management.jmxremote
-Dcom.sun.management.jmxremote.authenticate=false
-Dcom.sun.management.jmxremote.ssl=false
-Dcom.sun.management.jmxremote.local.only=false
-Dcom.sun.management.jmxremote.port=1099
-Dcom.sun.management.jmxremote.rmi.port=1099
-Djava.rmi.server.hostname=127.0.0.1
</code></pre>

<p>The critical part here is that:</p>

<ul>
<li><p>The same port should be used as 'jmxremote.port' and 'jmxremote.rmi.port'. This is needed to forward one port only.</p></li>
<li><p>127.0.0.1 should be passed as rmi server hostname. This is needed for JMX connection to work via port-forwarding.</p></li>
</ul>

<p>2). Forward the JMX port (1099) to your local PC via kubectl:</p>

<pre><code>kubectl port-forward &lt;your-app-pod&gt; 1099
</code></pre>

<p>3). Open jconsole connection to your local port 1099:</p>

<pre><code>jconsole 127.0.0.1:1099
</code></pre>

<p>This way makes it possible to debug any Java pod via JMX without having to publicly expose JMX via K8 service (which is better from security perspective).</p>

<p>Another option that also may be useful is to attach the Jolokia (<a href="https://jolokia.org/" rel="noreferrer">https://jolokia.org/</a>) agent to the Java process inside the container so it proxies the JMX over HTTP port and expose or port-forward this HTTP port to query JMX over HTTP.</p>
