Break-glass · 06 of 07 · Time
The life of a session, and how it ends
Every clock in break-glass is short on purpose. Approval lapses, sessions expire, idle terminals end, and the cluster has its own timer in case everything else forgets.
The life of a session, and how it ends
A session has four states. Requested, on Flight, has 30 minutes to be approved. Approved has 10 minutes to be started. Active lasts 15, 30 or 60 minutes, plus one 15-minute extension; a Ground session and a glass-broken session open straight into Active. Ended never reopens. A session ends when you end it, when it expires, after 10 idle minutes, 2 minutes after the terminal tab is closed, when the shell exits, when the pod is gone, or when an admin or the approver terminates it. A glass-broken session also becomes review due, with a reminder at 24 hours and an escalation at 72 hours. When it ends, in this order: close the terminal and the Kubernetes stream; delete the copy pod in copy mode; restart the live pod, unless it is the last ready one; remove the grant, the RoleBinding; store the recording with its SHA-256, anchor it in Rekor, and audit. If Backstage never comes back, the TTL label on the grant and the copy pod lets Kyverno's cleanup controller delete both, and a restarted backend ends every orphaned session within 15 seconds.
A SESSION Requested Flight: 30 min to approve Approved 10 min to press Start Active 15/30/60 min · +15 once Ended never reopens GROUND OPENS HERE GLASS BROKEN TOO it ends when you end it, at its time, idle 10 min, tab closed 2 min, shell exit, pod gone, or terminated Review due glass broken only remind at 24 h · escalate at 72 h WHEN IT ENDS, IN THIS ORDER 1 Close terminal and the k8s stream 2 Delete the copy copy mode 3 Restart the pod not a last ready one 4 Remove the grant the RoleBinding 5 Store and audit SHA-256 · Rekor If Backstage never comes back the TTL label on the grant and the copy pod: Kyverno cleanup deletes both · a restarted backend ends every orphan in 15 s A forgotten tab costs two minutes, not a standing door into production. LEGEND Waiting Open Done Cluster-side Glass broken
Pick the shortest duration that will do. One free extension, audited, and then it is a new request.
The pod is restarted and the copy deleted while the grant still exists, and only then is the grant removed. Anything left over is written on the record as a note.
The TTL label is set to the session plus fifteen minutes at creation. The cluster deletes the grant at that time, whatever state Backstage is in.