ksail workload mirror

Mirror a Deployment's inbound traffic to the local machine (read-only).

Resolves the Deployment to a running pod, injects a read-only tap (an ephemeral
container holding only CAP_NET_RAW), and streams a tcpdump pcap capture of the
service port over the Kubernetes exec channel — no reverse tunnel, no traffic
interception, the workload keeps serving untouched.

The capture runs until interrupted (Ctrl-C). By default it is written to
mirror.pcap and summarized on stop; --output - streams the raw pcap to stdout
for piping into tshark/wireshark.

With --to, the mirrored inbound TCP payloads are additionally replayed LIVE to
a locally-running process (one local connection per mirrored flow) while the
capture runs — the dev-loop bridge: your local service receives the same
requests the cluster workload is serving. Replay is one-way by design: the
local process's responses are read and discarded, nothing flows back into the
cluster.

Ephemeral containers cannot be removed, so an already-injected tap on the
target pod is reused rather than treated as an error.

Usage:
  ksail workload mirror <deployment> [flags]

Examples:
  # Mirror the traffic your app receives on port 8080 into mirror.pcap
  ksail workload mirror my-app --port 8080

  # Mirror a specific container of a multi-container Deployment in a namespace
  ksail workload mirror my-app -n prod -c api --port 8080

  # Pipe the live capture straight into tshark
  ksail workload mirror my-app --port 8080 --output - | tshark -r -

  # Replay the mirrored requests live to the copy running on your machine
  ksail workload mirror my-app --port 8080 --to localhost:8080

Flags:
  -c, --container string       Container whose traffic is mirrored (required when the Deployment has several)
      --context string         Kubeconfig context of the target cluster
  -n, --namespace string       Namespace of the target Deployment (default "default")
  -o, --output string          Destination pcap file, or '-' to stream the raw pcap to stdout (default "mirror.pcap")
  -p, --port int               Service port to capture TCP traffic on (required)
      --tap-image string       Image the injected tap container runs (default "docker.io/nicolaka/netshoot:v0.16")
      --tap-timeout duration   How long to wait for the tap container to reach Running (default 1m0s)
      --to string              Local address (host:port) the mirrored inbound TCP payloads are replayed to, live

Global Flags:
      --benchmark       Show per-activity benchmark output
      --config string   Path to config file (default: ksail.yaml found via directory traversal)
      --experimental    Enable experimental (unstable) commands and features