How do we run incident response without direct SSH or kubectl access?

QUESTION

How do we run incident response without direct SSH or kubectl access?

ANSWER

A shared Slack channel between vendor and customer is standard. The vendor defines debug actions for read-only visibility, and the customer can enable break-glass to elevate permissions for the duration of the incident. Everything is audit-logged.