ksail workload intercept

Intercept a Deployment's inbound traffic to a local process (reverse dev bridge).

Resolves the Deployment to a running pod, injects a steering container (an
ephemeral container holding only CAP_NET_ADMIN), and runs the steering agent in
it over the Kubernetes exec channel. The agent installs an iptables REDIRECT rule
that captures the workload's inbound TCP and forwards it, over a multiplexed
tunnel, to a process running on your machine — so the copy on your laptop serves
the cluster's live requests.

Unlike `workload mirror` (read-only pcap, traffic keeps flowing to the
workload), intercept steers the traffic away from the workload to your local
process; the agent removes its rule again on exit, restoring the pod.

The intercept runs until interrupted. Ctrl-C stops it cleanly with exit status 0,
tearing the tunnel down and letting the in-cluster agent reverse its redirect.

By default intercept runs the KSail-shipped steering image and derives the agent
command from --service-port, so only --service-port and --local-port are needed.
Pass an explicit --steer-image and --steer-command to run a custom agent instead.

Ephemeral containers cannot be removed, so an already-injected steering agent on
the target pod is reused rather than treated as an error.

Usage:
  ksail workload intercept <deployment> [flags]

Examples:
  # Intercept the traffic my-app serves on :8080 and forward it to localhost:8080
  ksail workload intercept my-app --service-port 8080 --local-port 8080

  # Intercept a specific container of a multi-container Deployment in a namespace
  ksail workload intercept my-app -n prod -c api --service-port 8080 --local-port 8080

  # Run a custom steering agent image and command instead of the KSail default
  ksail workload intercept my-app --local-port 8080 \
    --steer-image ghcr.io/acme/ksail-steer:latest \
    --steer-command ksail-steer --steer-command --port=8080

Flags:
  -c, --container string            Container whose traffic is intercepted (required when the Deployment has several)
      --context string              Kubeconfig context of the target cluster
  -l, --local-port int              Local port the intercepted inbound traffic is forwarded to (required)
  -n, --namespace string            Namespace of the target Deployment (default "default")
      --service-port int            Workload port to intercept; KSail derives the default steering command from it (alternative to an explicit --steer-command)
      --steer-command stringArray   Command the in-cluster steering agent container runs, exec'd over the tunnel (default: derived from --service-port for the KSail steering image)
      --steer-image string          Image the injected steering container runs (must carry the agent binary and iptables) (default "ghcr.io/devantler-tech/ksail-steer:latest")
      --wait-timeout duration       How long to wait for the steering container to reach Running (default 1m0s)

Global Flags:
      --benchmark       Show per-activity benchmark output
      --config string   Path to config file (default: ksail.yaml found via directory traversal)
      --experimental    Enable experimental (unstable) commands and features