Verify Open Interactive Shell on a Kubernetes ClusterIP (port-forwarded) target

[tnaum-ms]

Summary

Verify that Open Interactive Shell works on a Kubernetes-discovered ClusterIP target (reached through a local port-forward tunnel), and decide whether it needs a Kubernetes-aware guard or works as-is via the standard cluster command.

This is task T1 from the PR #621 (Kubernetes service discovery) UX review closeout (§12.1 of docs/ai-and-plans/PRs/621-kubernetes-discovery/bugbash-090-kubernetes-ux-review.md).

Background

After the §9 refactor, the Kubernetes discovery cluster node exposes the standard DocumentDB cluster context menu (Create Database, Copy Connection String, Open Interactive Shell, Data Migration). For ClusterIP services the connection is only reachable through a local port-forward tunnel to 127.0.0.1:<localPort>, which is established on expand/connect. The interactive shell path has not yet been verified live against such a target.

Steps to verify

1. Discover a ClusterIP DocumentDB target on a live cluster (kind/minikube locally, or AKS).
2. Expand/connect the node so the port-forward tunnel is established.
3. Run Open Interactive Shell on the node.
4. Confirm the shell connects against 127.0.0.1:<localPort> and basic commands work.

Acceptance criteria

• Interactive shell connects successfully on a live ClusterIP target with an active tunnel.
• If the tunnel is not yet established when the shell is launched, behavior is sensible (either the tunnel is established first, or the user gets a clear message) — no silent failure or confusing error.
• Decision recorded: does the shell command need a Kubernetes-aware guard (e.g. ensure-tunnel-first), or does it work as-is? If a guard is added, note where.

Pointers

• Node: src/plugins/service-kubernetes/discovery-tree/KubernetesServiceItem.ts
• Port-forward tunnel: src/plugins/service-kubernetes/portForwardTunnel.ts, metadata in src/plugins/service-kubernetes/portForwardMetadata.ts
• Related copy path (for reference on how read-only credentials avoid opening a tunnel): src/commands/copyConnectionString/copyConnectionString.ts

Filed for the 0.9.1 milestone as a follow-up from the Kubernetes discovery UX review (PR #621).