maqpna attach
Attach to the agent process of a session (kubectl attach; privileged, audited)
Synopsis#
maqpna attach SESSION | sess/NAME [-n NS] [-c CONTAINER] [-i] [-t]Description#
Like exec: an RBAC check (pods/attach), a PrivilegedAccess event on the session, then kubectl attach.
Flags#
| Flag | Type | Description | Default |
|---|---|---|---|
--allow-gateway-mismatch | switch | send the context's login token to a gateway other than the one it was issued for (env MAQPNA_ALLOW_GATEWAY_MISMATCH=1) | none |
-c, --container | string | same as -c | agent |
--gateway | string | gateway base URL (env MAQPNA_GATEWAY_URL; default: the context's gateway) | none |
-i, --stdin | switch | pass stdin to the container | none |
-n, --namespace | string | namespace | default |
--oidc-token-file | string | file holding an OIDC access token for the admin API (env MAQPNA_OIDC_TOKEN_FILE); wins over --token | none |
-t, --tty | switch | allocate a TTY | none |
--token | string | static admin token (env MAQPNA_ADMIN_TOKEN; dev/break-glass) | none |
The global flags (--context, -o, --no-color, ...) work with every command.
Examples#
maqpna attach coder-x1 -n team-aWhat happens when you run it#
- Talks to the gateway:
--gateway, elseMAQPNA_GATEWAY_URL, else the current context's gateway (maqpna context). - Authenticates to the admin API with the token stored by
maqpna login,--oidc-token-file, or a static--token(MAQPNA_ADMIN_TOKEN).
Exit codes#
| Code | Meaning |
|---|---|
0 | success |
1 | error (the message says what failed, with a hint when there is one) |
2 | usage error: unknown flag, missing argument or bad value; the synopsis is printed |
3 | a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command) |