Skip to main content

honey intercept

honey intercept​

Run a local command whose network and files traverse a target Kubernetes pod

Synopsis​

Deploy an OPA-gated, audited interception agent and run a local command whose egress, DNS, incoming traffic, and files traverse it.

The command after -- runs locally under the injector; everything before -- is parsed as flags and, optionally, the target pod name.

When <pod> is omitted, the session is targetless: a standalone agent (not attached to any pod) that supports egress and DNS only — no incoming traffic and no files — and survives target workload redeploys.

Example: honey intercept api-0 -n apps --mode egress -- curl http://internal.svc honey intercept api-0 -n apps --mode incoming --target 127.0.0.1:8080 -- ./my-server honey intercept -n apps -- curl http://internal.svc

honey intercept [&lt;pod&gt;] [-- &lt;command&gt;] [flags]

Options​

      --actor string          Actor recorded in the policy gate and audit log (default: $USER)
      --admin-url string      honey web base URL for server-brokered interception (default $HONEY_WEB_URL) (default "http://localhost:8765")
      --agent-image string    Interception agent container image (default from config)
      --cluster string        Target cluster name (resolves kubeconfig/context from k8s_proxy.clusters; default: current kubeconfig context)
      --container string      Target container the agent shares namespaces with (default: the pod's first container)
      --env-exclude strings   With --mode env, drop these target env var names from the overlay (repeatable; mutually exclusive with --env-include)
      --env-include strings   With --mode env, overlay only these target env var names (repeatable; mutually exclusive with --env-exclude)
  -h, --help                  help for intercept
      --mode strings          Interception modes to enable: egress|incoming|files|env (repeatable; default from config)
  -n, --namespace string      Target pod namespace (default: the kubeconfig context's namespace, like kubectl)
      --target string         Local application address incoming traffic is forwarded to (host:port; required with --mode incoming)
      --udp                   Include UDP tunnels alongside TCP

Options inherited from parent commands​

      --cache-dir string     Override cache directory (default: XDG_CACHE_HOME/honey)
      --cache-ttl duration   Cache time-to-live (host discovery) (default 10m0s)
      --config string        Path to honey YAML (optional; also HONEY_CONFIG or default paths)
      --debug-log string     Path to write debug logs (disables debug logging if empty)
      --no-cache             Bypass read/write cache (host discovery)
      --record-dir string    Session recording directory for search (TUI), web, and cue-exec; overrides defaults.record_dir; default &lt;directory of config.yaml&gt;/records
      --refresh              Ignore cached entries and refresh (host discovery)

SEE ALSO​

  • honey - DevOps tool to help find an instance in sea of clouds