Developer Test Guide

Purpose

A hands-on walkthrough for a developer to exercise Isolate: open an audited database connection, get audited Kubernetes access, and run a recorded kubectl exec session. Every database query and kubectl command is logged to the audit trail.

Prerequisites

  • Isolate CLI (v0.6.0+): brew install boost-devops/tap/isolate then isolate version
  • kubectl ≥ 1.31 — required for exec. The proxy refuses exec/attach from clients that can't use the WebSocket streaming protocol, because only WebSocket sessions can be recorded. kubectl 1.31+ negotiates this automatically; older clients are rejected with a clear message (an intentional, fail-closed audit control).
  • For DB access via GCP: the gcloud CLI installed and authenticated.

Log in

isolate config set --server https://isolate-dev.saucedsoiree.com
isolate login        # SSO via browser
isolate whoami       # confirm your email + role

A. Kubernetes exec — audited & recorded

Open the audited proxy tunnel to a cluster, then use kubectl normally. Standard API calls are audited; interactive exec sessions are captured to a replayable recording. 

# 1. Open the audited tunnel (keep this running):
isolate k8s connect <cluster-name>
#    → writes a kubeconfig and prints an `export KUBECONFIG=...` line

# 2. In another shell, point kubectl at it:
export KUBECONFIG=~/.isolate/kubeconfig-<cluster-name>.yaml
kubectl get pods                          # standard API call — audited
kubectl exec -it <pod> -- sh              # interactive shell — recorded
#    run some commands, then `exit`

List available clusters with isolate k8s clusters. If a cluster requires approval, an approver must approve the request before the session opens.

B. Database connect — audited SQL

DB connect is approval-gated: a connection request must be approved (in the Connect page or via Slack) before the tunnel opens. Have an approver ready, or approve it yourself from the dashboard if you have permission. 

isolate list                                  # see available instances
isolate connect <instance-id> --port 15432    # request + open tunnel (waits for approval)

# once approved, in another shell:
psql "host=localhost port=15432 user=isolate dbname=<db>"
#    every statement you run is recorded to the audit log

Don't have an instance? Create one from a backup on the New Instance page.

Verifying the audit trail

Confirm your activity was recorded on the Audit page — it shows every SQL query and Kubernetes API call, and links to the TTY recording of each exec session for replay.

Troubleshooting

  • "exec/attach requires a WebSocket-capable client" — your kubectl is older than 1.31. Upgrade it; the proxy refuses exec it cannot record.
  • Connection waits forever — a DB connection is pending approval; approve it from the Connect page.
  • Tunnel drops — keep isolate k8s connect / isolate connect running while you use the connection.

See also the Getting Started guide and the provider-specific docs.