Bake in Kubernetes port-forwarding

[rolandwalker]

Description

The --kubectl-resource option names a Kubernetes resource, usually in the form type/name, to which a tunnel is created using the kubectl CLI tool. Mycli then connects over that tunnel.

The --port option will be needed if the remote service is on a nonstandard port, for example

mycli --kubectl-resource=pod/mysql --user=root --port=13306

It is unfortunate that our three tunneling options have quite different spellings

--ssh-jump
--boundary-id
--kubectl-resource

However, there is meaning behind them for each case. In this case, the terminology in Kubernetes for the value of the argument is exactly a "resource" (and Kubernetes has very precise terminology). And we wouldn't call it a "jump" because the tunnel terminates at the resource.

DSNs also support kubectl_resource as a query parameter.

Future work: it is not entirely clear whether use of the keyring should be suppressed for all kubectl connections. It is kept off here, because of obvious issues with a naive implementation. For instance, the Kubernetes context is ignored here. While the context can be set via --kubectl-options, it is not tracked by our logic, and there is no way to make it part of the keyring identifier. Yet changing the context would change which resource we connect to, and presumably the needed credentials would change.

Limitation: kubectl can port-forward to a named port on the resource we are connecting to, but the mycli --port option only accepts integers. So, there is an argument for adding a second option --kubectl-port or incorporating the (possibly non-integer) port into the resource string. Or for extending --port to accept strings when --kubectl-resource is given. Each would add complexity, and nothing stops us from choosing one of those paths later if there is such a need. Since named ports correspond to integers, the current functionality ought to be sufficient.

Checklist

• I added this contribution to the changelog.md file.
• I added my name to the AUTHORS file (or it's already there).
• To lint and format the code, I ran

  uv run ruff check && uv run ruff format && uv run mypy --install-types .