Create a portforward request against a known pod and port.

The API server opens a stream to the kubelet, which connects to that port inside the pod.

The caller's own machine now talks to the pod's listener directly, with no route into the pod network and no Service or Ingress in front of it.

Databases, admin consoles, and debug handlers bound inside the pod are reachable, including ones bound to loopback that no Service could expose.

The tunnel is not pod-to-pod traffic, so a NetworkPolicy written to isolate the workload does not apply to it.

Unlike the API-server proxy subresources, this needs no HTTP semantics.

Any TCP protocol works, which is what makes it useful against non-HTTP listeners.