Break-glass · 04 of 07 · Guardrails

Seven layers, each assuming the last one failed

Layers 1 to 3 are the portal being careful. Layers 4 to 6 are the cluster refusing to take the portal's word for it. Layer 7 is what makes the rest provable afterwards.

Seven layers, each assuming the last one failed A request passes seven layers from top to bottom. 1, Tower in your browser shows only what you may do; it is a convenience and never trusted, because every route checks again. 2, Backstage's permission framework: owners request, owners and admins approve, only admins break glass; anyone else gets a 403. 3, the backend's rules: the tier comes from cicd.yaml and the cluster, never the request; nobody approves their own; one open session per person; the namespace's labels must name the app. 4, just-in-time RBAC: Backstage has no debug rights at rest and binds one debug role to itself per session; it may bind only two roles, and Kubernetes' escalation check refuses anything else. 5, admission policies in the API server, failing closed: the grant's shape, the image digest and signature, the security context, and no exec; a buggy or compromised backend still cannot widen what a session can do. 6, expiry: a hard stop, 10 minutes idle, 2 minutes disconnected, and a TTL label, so Kyverno's cleanup deletes the grant even if Backstage never comes back. 7, record and review: every byte recorded, hashed, locked for a year and anchored in a transparency log; no recording means no session, and a glass-broken session is always reviewed. A REQUEST1 · Toweryour browserShows only what you may do, and why the rest is greyed outa convenience, never trusted: every route checks again2 · Permissionsbackstage permission frameworkOwners request, owners and admins approve, admins break glassanyone else gets a 4033 · Backend rulestower backendThe tier comes from cicd.yaml and the cluster, never the requestno self-approval · one open session each · namespace labels must name the app4 · Just-in-time RBACkubernetes rbacNo debug rights at rest: one RoleBinding to itself, per sessionmay bind two debug roles only; the escalation check refuses anything else5 · Admissionapi server · fails closedGrant shape, image digest and signature, securityContext, no execa buggy or compromised backend still cannot widen what a session can do6 · Expirytimers, and the clusterHard stop, 10 minutes idle, 2 minutes disconnected, a TTL labelKyverno's cleanup deletes the grant even if Backstage never comes back7 · Record and reviewaudit · object lock · rekorEvery byte recorded, hashed, locked for a year, anchoredno recording, no session · a broken glass is always reviewedNo layer trusts the one above it.LEGENDEnforced by BackstageEnforced by the clusterEvidence afterwardsPasses every layer

The portal

Permissions and backend rules stop the honest mistakes and the crafted requests: the wrong app, the wrong tier, your own approval.

The cluster

RBAC and admission policies are the second lock, in the API server itself. They are there for the day the portal has a bug, or worse.

The record

A shell nobody watched live is still a shell everybody can replay. That is the trade that makes the rest acceptable.

Hangar · Tower · Break-glass