Why is classic confinement not an option for you? We have a process Process for reviewing classic confinement snaps that is available to everyone. The first step is that the technical requirements need to be understood. Understand that in Manual Review for Classic Confinement of kubefwd I was making suggestions based on the information given and it seemed like strict mode might work for you (all that was said was “requires access to ~/.kube/config, the /etc/hosts file and full network access to create and bind port forwarders to local loopback IPs.” – that can be covered with strict mode).
Now you say that “if kubectl requires classic confinement then probably more so kubefwd”, which is fine, but we should look into why that is in Manual Review for Classic Confinement of kubefwd. I suggest you discuss the requirements over there and we can move forward.