Use case · Cloud infrastructure
Keep cluster mutations and remote debugging reviewable
Route cluster mutations, in-container execution, tunnels, and Helm lifecycle changes through review before they hit the cluster.
kubectl and Helm can rebuild or unravel a cluster in one command. The catalog documents a 28-operation matrix for cluster mutations, remote execution, file transfer, tunnels, certificate decisions, and Helm lifecycle, plus a separate entry for operations that can reveal Secret payloads.
Evidence grade: reviewed catalog facts · Last reviewed 2026-09-12
Every step below references coverage documented in the HOL Guard extension catalog. These workflows are derived from reviewed catalog facts, not independently run or benchmarked — verify the result in your own setup before relying on it.
When this is not the right fit
Skip this workflow if
- You only run read-only queries — the catalog documents mutations, remote execution, file transfer, tunnels, certificate decisions, and Helm lifecycle, and does not document a read-operation matrix.
- The change is a cloud resource delete rather than a cluster operation — the cloud-teardown workflow covers resource deletion.
Prerequisites
Before you start
- Guard is installed on the machine where kubectl and Helm run.
- You know which roles can run cluster-mutating commands.
Steps
The workflow
- 1
Review in-container execution and debugging
The Kubernetes operations entry reviews arbitrary command execution inside a running container (kubectl exec), ephemeral debug containers and node namespaces (kubectl debug), and file transfer (kubectl cp).
- 2
Review deletions and forced replacement
The same entry reviews deletion of live cluster resources (kubectl delete) and forced replacement that deletes and recreates a resource without graceful handoff (kubectl replace --force), alongside node drains and taints.
- 3
Review Helm lifecycle changes
Helm install, upgrade, rollback, and uninstall are reviewed operations — an uninstall removes a release and its managed cluster resources.
- 4
Review operations that reveal secrets
The Kubernetes secrets entry reviews cluster CLI operations that can reveal Secret payloads, such as kubectl get secret with output flags, with a review default and high severity.
Expected result
What the documented coverage should do
Cluster mutations, remote execution, tunnels, and Helm lifecycle operations that match the documented matrix pause for a review decision before they reach the cluster, and Secret-revealing reads are surfaced for review as well.
Limitations
What this workflow does not claim
- The matrix covers documented kubectl and Helm operations; custom controllers and CRD-specific tooling are not in it.
- Coverage is limited to the reviewed operations and the surrounding Guard policy, per the catalog’s stated limitations.
Coverage referenced
Extensions in this workflow
- Kubernetes operation protectioncommand.kubernetes-operations
- Kubernetes secret protectioncommand.kubernetes-secrets