Break-glass · 02 of 07 · The shape
How a session works
Tower never hands out access. Its backend borrows a narrow role for itself, in one namespace, for one session, and gives it back when the session ends.
How a session works
Four zones. Your browser runs Tower and holds no Kubernetes credential; it talks only to Backstage. In Backstage, Tower's backend has three parts: the break-glass routes, which check permission, decide the tier and check the target; the terminal relay, a WebSocket to the debug container's attach stream that records everything; and the sweep and timers, which enforce the hard stop, the idle limit and the disconnect limit. The backend holds no debug rights at rest. In the app namespace on the prod cluster, every write passes admission policies that run in the API server and fail closed. Step 1: Backstage grants itself a RoleBinding to a debug role in that namespace, with a time-to-live label of 15 to 75 minutes. Step 2: it adds a debug container, user 65532 and read-only, to the app pod, which keeps serving, and attaches to it. The sweep and timers end the session, clean up, restart the pod and revoke the grant. Evidence is kept off the cluster it records: every byte goes to a recording store with object lock for 365 days, its SHA-256 is anchored in a Rekor transparency log, and every step goes to the audit log.
YOUR BROWSER BACKSTAGE · TOWER BACKEND THE APP NAMESPACE · PROD CLUSTER EVIDENCE · KEPT OFF THE CLUSTER IT RECORDS Tower, in the browser no Kubernetes credential Break-glass routes permission · tier · target Terminal relay WebSocket to attach · records Sweep and timers ends, cleans up, revokes no debug rights at rest Admission policies in the API server · fail closed · every write RoleBinding to itself · TTL 15-75m The app pod serving, as before Debug container uid 65532 · read-only 1 GRANT ITSELF 2 ADD AND ATTACH Audit log every request, decision and play Recording store asciicast · object lock · 365 days Transparency log Rekor · the recording's SHA-256 EVERY BYTE EVERY STEP The person never holds a credential. The portal holds one for minutes, and the cluster checks it. LEGEND You Backstage A fence or a grant The session Evidence Writes Records
The browser only ever talks to Backstage. There is no kubeconfig to copy, no token to paste into a laptop, nothing to revoke afterwards.
Backstage can create RoleBindings to two debug roles and nothing else. Each session binds one, in one namespace, and deletes it at the end.
Recordings land in a locked bucket on the dev cluster, not on the prod cluster they record, and the hash goes into a transparency log.