kubefwd over ssh

Currently, if you run tilt in an SSH session, the kubefwd extension will fail with this error:

Error executing command as another user: No authentication agent found.

The problem is that

1. kubefwd needs sudo access
2. the kubefwd extension asks for sudo access with pkexec
3. pkexec can't call out to a GUI sudo, so fails

I'm not sure what the right solution for this is. Here's a few ideas I tossed around:

Could we multiplex the TTYs so that we could gracefully handle it when one asks for sudo access? I don't think the underlying OS APIs offer a reasonable way to do this though.

I considered adding an option to expose the tty as a web app in the tilt UI (as in https://github.com/yudai/gotty). But I think there are security concerns with that.

Could we add a tilt attach command, like kubectl attach or docker attach to attach a TTY to an existing session when you need to input a password? This is probably the most common solution in this space.

What if we told people that you should make your sudo password a Secret (either in kubernetes, or in the tilt apiserver)? Then kubefwd could read that secret when it needs to. But I'm a bit worried this just kicks the can somewhere else without resolving the problem (when/how to notify the user when a program is requesting elevated privileges).

Start by reproducing the kubefwd extension failure when Tilt runs in an SSH session, then inspect how the extension invokes pkexec and requests sudo access. Compare the discussed approaches—TTY multiplexing, a Tilt attach command, or secret-based password handling—and define a secure way to handle interactive authentication remotely.