PortForwardDoctor
A focused diagnostic for the specific k9s-vs-kubectl port-forward class of bugs: point it at a cluster, run a port-forward attempt, and it tells you whether the issue is RBAC (create vs get on pods/portforward), SPDY vs WebSocket feature gate, or a network policy — and generates the one-line fix.
Kubernetes operators debugging 'why is port-forward greyed out / failing'
- Live SelfSubjectAccessReview probe for both create and get verbs on pods/portforward
- Feature-gate detector that checks if PortForwardWebsockets is enabled on the target cluster
- Network-policy simulator that reproduces the SPDY→WebSocket protocol switch
- Drop-in RBAC patch YAML and a kubectl manifest that re-grants the missing verb
The Dev.to story is literally about this bug surviving in a 58k-star project — proving even senior maintainers miss the dual-protocol semantics.
Real recurring pain point: open k9s issue #4144 explicitly documents the RBAC create-vs-get bug, and multiple Stack Overflow threads (78238431, 47484312) show kubectl port-forward failures are common, but the use case is narrow and Dev.to post only got 10 reactions — modest engagement.BUG: Port-forward pre-flight check always requires create on pods/portforward · Issue #4144 · derailed/k9s ↗Error in port forwarding when using kubectl - Stack Overflow ↗
No focused port-forward diagnostic tool exists; competing space is broad K8s troubleshooting platforms (Komodor, Lens, Robusta) that do not target this specific failure mode — bug literally persists unfixed in 34.3k-star k9s because tooling gap is unfilled.Port Forward - Port Not Available · Issue #3181 · derailed/k9s ↗Best DevOps Tools 2025: We Tested 25+ Solutions ↗
Hard to charge for — Komodor proves K8s debugging has paying customers (~$30/node/mo) but only as a broad platform; a single-bug CLI is hard to monetize beyond a tip-jar donation model, and free krew/kubectl plugin ecosystem sets low price expectations.Komodor Pricing 2026 | Plans, Cost & Free Tier ↗Pricing and Plans | Komodor ↗
Once k9s patches issue #4144 (upstream already has the WebSocket dialer in source), the primary reason this tool exists disappears; Kubernetes port-forward itself is durable but the dual-protocol RBAC edge case is a transient 1.31+ migration issue.BUG: Port-forward pre-flight check always requires create on pods/portforward · Issue #4144 ↗
Trivially buildable as a kubectl plugin / small CLI that runs subject access reviews against the API server and checks feature gates + network policies — well-scoped, days of work, no ML required.