maqpna exec
Run a command in a session's sandbox (kubectl exec; privileged, audited)
Synopsis#
maqpna exec SESSION | sess/NAME | ag/AGENT [-n NS] [-c CONTAINER] [-i] [-t] -- COMMAND [ARG...]
maqpna exec SESSION --governed [-n NS] [--gateway URL] -- COMMAND [ARG...]Description#
exec runs kubectl exec in the session's sandbox pod (default container: agent) after checking that you may create pods/exec there, and records a Warning event PrivilegedAccess on the AgentSession. It bypasses the gateway's tool policy: prefer --governed, which runs the command through the gateway's session API (maqpna session exec: policy-checked, in the audit ledger). Needs kubectl on PATH.
Flags#
| Flag | Type | Description | Default |
|---|---|---|---|
--allow-gateway-mismatch | switch | send the context's login token to a gateway other than the one it was issued for (env MAQPNA_ALLOW_GATEWAY_MISMATCH=1) | none |
-c, --container | string | same as -c | agent |
--gateway | string | gateway base URL (env MAQPNA_GATEWAY_URL; default: the context's gateway) | none |
--governed | switch | run through the gateway's session API (policy-checked, audited) instead of the pod | none |
-i, --stdin | switch | pass stdin to the container | none |
-n, --namespace | string | namespace | default |
--oidc-token-file | string | file holding an OIDC access token for the admin API (env MAQPNA_OIDC_TOKEN_FILE); wins over --token | none |
-t, --tty | switch | allocate a TTY | none |
--token | string | static admin token (env MAQPNA_ADMIN_TOKEN; dev/break-glass) | none |
The global flags (--context, -o, --no-color, ...) work with every command.
Examples#
maqpna exec coder-x1 -n team-a -it -- sh
maqpna exec coder-x1 --governed -n team-a -- ls /workspaceWhat happens when you run it#
- Talks to the gateway:
--gateway, elseMAQPNA_GATEWAY_URL, else the current context's gateway (maqpna context). - Authenticates to the admin API with the token stored by
maqpna login,--oidc-token-file, or a static--token(MAQPNA_ADMIN_TOKEN).
Exit codes#
| Code | Meaning |
|---|---|
0 | success |
1 | error (the message says what failed, with a hint when there is one) |
2 | usage error: unknown flag, missing argument or bad value; the synopsis is printed |
3 | a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command) |