Break-glass · 07 of 07 · Honest notes
An honest report card
Where it holds up, and where a good security team would push. Graded by me, so read it as the case for the defence, with the weak spots left in.
An honest report card
Eight areas graded on October 12, 2026. Exec removed: A minus, refused on Flight by the cluster, though platform operators keep it by design. Who can open one: A, owners only, checked on every route, with the tier decided by the server. Least privilege: A, no standing rights and a per-session grant the API server checks. The debug container: A, pinned, signed, non-root, read-only, no capabilities and no ServiceAccount token. Two-person rule: B, because Backstage writes the approver name the cluster checks, and admins can skip it by breaking the glass. Evidence: B plus, locked for a year, hashed and anchored, but in a self-hosted transparency log and with governance-mode retention. Data exposure: C plus, because process and volume access can read Secrets, egress is open, and recordings keep whatever was shown. Staying up: A minus, native policies that fail closed, though the signature check still needs Kyverno. Overall: B plus, strong where the cluster enforces it and softest where it has to trust Backstage or the person.
TOWER BREAK-GLASS · GRADED OCTOBER 12, 2026 Exec, removed A- Refused on Flight by the cluster; platform operators keep it, by design Who can open one A Owners only, checked on every route, tier decided by the server Least privilege A No standing rights; a per-session grant the API server checks The debug container A Pinned, signed, non-root, read-only, no capabilities, no token Two-person rule B Backstage writes the approver name the cluster checks; admins can skip it Evidence B+ Locked a year, hashed, anchored; but self-hosted log, governance mode Data exposure C+ Process and volume access read Secrets; open egress; recordings keep it Staying up A- Native policies, fail closed; the signature check still needs Kyverno Overall B+ Strong where the cluster enforces it. Softest where it has to trust Backstage or the person. An A for the design. The B+ is for where it lives today. LEGEND Holds up Where a security team will push
No standing exec on Flight, no credential in anyone's hands, and a cluster that checks every field of every grant and container.
Backstage is the one principal that can create grants. Protect it like a tier-0 system, because the two-person check in the cluster reads names Backstage wrote.
A read-only shell next to a database, with the app's credentials, is data access. The approver and the recording are the controls, not the container.