Kubectl hardener
Run av harden kubectl to apply this hardener and
av doctor kubectl to verify it.
The kubectl hardener installs the signed, unmodified kubectl Isotope
and rewrites one safe kubeconfig to use Kubernetes' native
ExecCredential protocol. Supported inline bearer tokens and
client certificate/key pairs move to Automic Vault before the kubeconfig
is replaced atomically.
The migration fails closed for multiple kubeconfig paths, basic authentication, credential files, auth-provider plugins, pre-existing exec plugins, ambiguous credentials, unsafe file ownership or permissions, and incomplete certificate pairs. Clusters must use HTTPS with certificate verification enabled. Every credential request initially requires approval and is bound to the exact kubeconfig user and Kubernetes API server.