ksail workload intercept

Intercept a Deployment's inbound traffic to a local process (reverse dev bridge).

Resolves the Deployment to a running pod, injects a steering container (an
ephemeral container holding only CAP_NET_ADMIN), and runs the operator-supplied
steering agent in it over the Kubernetes exec channel. The agent installs an
iptables REDIRECT rule that captures the workload's inbound TCP and forwards it,
over a multiplexed tunnel, to a process running on your machine — so the copy on
your laptop serves the cluster's live requests.

Unlike `workload mirror` (read-only pcap, traffic keeps flowing to the
workload), intercept steers the traffic away from the workload to your local
process; the agent removes its rule again on exit, restoring the pod.

The intercept runs until interrupted (Ctrl-C), which tears the tunnel down and
lets the in-cluster agent reverse its redirect.

--steer-command is required and --steer-image must carry the agent binary plus
iptables: KSail does not yet ship a default steering-agent image (tracked as a
follow-up), so the agent is operator-supplied for now.

Ephemeral containers cannot be removed, so an already-injected steering agent on
the target pod is reused rather than treated as an error.

Usage:
  ksail workload intercept <deployment> [flags]

Examples:
  # Intercept the traffic my-app receives and forward it to localhost:8080
  ksail workload intercept my-app --local-port 8080 \
    --steer-image ghcr.io/acme/ksail-steer:latest \
    --steer-command ksail-steer --steer-command --port=8080

  # Intercept a specific container of a multi-container Deployment in a namespace
  ksail workload intercept my-app -n prod -c api --local-port 8080 \
    --steer-image ghcr.io/acme/ksail-steer:latest --steer-command ksail-steer

Flags:
  -c, --container string            Container whose traffic is intercepted (required when the Deployment has several)
      --context string              Kubeconfig context of the target cluster
  -l, --local-port int              Local port the intercepted inbound traffic is forwarded to (required)
  -n, --namespace string            Namespace of the target Deployment (default "default")
      --steer-command stringArray   Command the in-cluster steering agent container runs, exec'd over the tunnel (required)
      --steer-image string          Image the injected steering container runs (must carry the agent binary and iptables) (default "docker.io/nicolaka/netshoot:v0.16")
      --wait-timeout duration       How long to wait for the steering container to reach Running (default 1m0s)

Global Flags:
      --benchmark       Show per-activity benchmark output
      --config string   Path to config file (default: ksail.yaml found via directory traversal)
      --experimental    Enable experimental (unstable) commands and features