Solved,
port-forward via kubectl opens a port on my local remote machine, not on the worker node the database is running on. Not easy to see.
I am now wondering how this tunnel is working. Does kubectl create a ssh pipe for it or is all trafix transferred unencrypted?