Tower's write actions are delegated and reviewed, so pod exec was never going to be a standing feature. But mid-incident an owner sometimes needs a process list, a DNS lookup from the pod's network, or a file the app wrote, and no log line answers it. This is the spec for doing that safely: short, approved, recorded, and enforced by the cluster itself.
| exec into the app | ephemeral debug container | |
|---|---|---|
| Admission control | allow or deny the whole thing | the policy sees the full container spec |
| What runs | the app image's tools, as the app's user | an approved, pinned image as a fixed non-root user |
| Writes | land in the app container | impossible: read-only root, read-only mounts |
| Minimal images | often no shell at all | always works |
| Trace in the pod | none | the container stays in the pod spec |
A debug container is safer for these reasons, not inherently. Run as the app's user with a shared process namespace, it reaches the same secrets as exec. So process access is a separate, explicit option that the approver sees.
The first build used fail-closed Kyverno policies on Flight too. On the dev cluster they made break-glass unavailable every time Kyverno lost its lease on a busy node, and on Flight that would happen during the incident itself. So Flight validation moved to built-in ValidatingAdmissionPolicy, and a slim Kyverno keeps only the two jobs it's uniquely good at: the cleanup TTL and the debug image's signature check.
The last piece is a plan for walking every feature in a browser with two people, one an admin and one an app owner, on a Skyport app's Ground and Flight environments. It covers the things a harness can't: the approval round trip, the notification deep links, a sensitive recording refused to the wrong person, and a "glass broken" session reviewed by someone else.
Non-root, no token, read-only; the recording's hash matches and is anchored in the Rekor transparency log.
Request, approve with "keep the pod", deny, end by the approver, and exec refused.
Broadcast to everyone, review due, never self-reviewed, and a fallback reviewer.
A locked bucket refuses deletes, and the hash checks against the log without Tower.
The TTL deletes a binding at fifteen minutes; process access is refused unless the session asked for it.