Restrict sub-commands

[JimBugwadia]

Any thoughts on providing the ability to restrict sub-commands?

For example, to run kubectl in a sandbox container and only allow get operations.

When running in Kubernetes, RBAC can be used.

But for additional security, is it possible to restrict usage of the CLI to a set of sub-commands?

  "commands": {
    "allow": [
      "kubectl get", 
      "kubectl logs",
      "kubectl describe"
    ]
  },

[lukehinds]

Let me come back to you shortly on this @JimBugwadia , its a tricky one, but I have something experimental which may work. The crux of why this becomes a challenge is that we don't get to see flags that are used, we just see a syscall. So the flags are already ingested into the application by the time it reaches us.

[kipz]

FWIW, my experiment over here supports this: #336

[lukehinds]

@JimBugwadia / @kipz sorry for late reply , I need to get better at tracking discussions

@kipz , going to respond as the tool sandboxing is definately something we should get in, I have it working on linux