kubefwd v1.25.15

Highlights

🔒 REST API now requires authentication (security)

The optional REST API (--api) and the HTTP MCP bridge previously served every endpoint — Kubernetes context enumeration, pod log reads, and port-forward creation — with no authentication. Because kubefwd runs as root via sudo -E, any local process could drive it against your kubeconfig. This release adds Bearer-token authentication, addressing advisory GHSA-vwjh-p4vp-9rp2 (#507, #508).

• The API key is resolved from KUBEFWD_API_KEY; if unset, a random 32-character hex key is generated and only its last 4 characters are logged on startup.
• All endpoints require Authorization: Bearer <key> except /api/health, which stays open for liveness probes.
• Token comparison uses crypto/subtle.ConstantTimeCompare to avoid timing side channels.
• kubefwd mcp reads KUBEFWD_API_KEY automatically; a new --api-key flag overrides it.

[!IMPORTANT]
Upgrade note: If you use --api or the HTTP MCP bridge, set a known key so automation/CI can authenticate instead of scraping a generated one from logs:

export KUBEFWD_API_KEY=my-known-key
sudo -E kubefwd svc -n my-namespace --api

🐛 Multi-port services recover after a single port is reset (#509)

Fixed an unrecoverable zombie state in which a multi-port service that lost one port's connection — e.g. the TCP RST behavior of kubernetes/kubernetes#111825 — would never re-establish that port or restore its /etc/hosts entries. Auto-reconnect (-a, on by default in --tui) found the pod but did nothing, and only a full kubefwd restart recovered the service.

syncNormalService now reasons in terms of the pod being forwarded rather than a single port: it keeps every port of that pod and re-establishes any that were torn down independently. This also fixes a related regression where a healthy multi-port service could drop all but one port on the periodic resync. (#509, #510)

Dependencies

• golang.org/x/sys → 0.45.0 (#502)
• github.com/modelcontextprotocol/go-sdk → 1.6.1 (#501)

CI / Build

• goreleaser/goreleaser-action → 7.2.2 (#500)
• github/codeql-action → 4.36.0 (#504, #499)
• golangci/golangci-lint-action → 9.2.1 (#506)
• docker/setup-buildx-action → 4.1.0 (#505)
• docker/login-action → 4.2.0 (#503)
• codecov/codecov-action → 6.0.1 (#498)

Full changelog: https://github.com/txn2/kubefwd/compare/v1.25.14...v1.25.15