kubectl session against a crash-looping cluster, or connect to a
database to diagnose a live incident.
Break glass is the surface for one-time access to a single named
resource, with a customer-approved session duration. You request it,
your customer reviews and signs that request, and the required network
path and credential are prepared. Session expiry starts cleanup of the
access break glass supplied. Your customer also removes any connector
bundle they applied; reported cleanup failures are retried and can require
follow-up.
When to use break glass
Break glass is deliberately separate from the standing operations channel. Reach for it only when a vetted command isn’t enough:
Both surfaces use customer-signed approvals. The appliance controller
verifies the approval against your customer’s pinned key before supplying
a credential. A connector session also requires your customer to apply
the reviewed connector bundle in their own account.
The two planes
Getting an operator onto a customer resource takes two independent things: a network path to reach it, and a credential to authenticate once there. Break glass models these as two planes and resolves each one per target.
Automatic network resolves the path from the resource. You can also
select a configured Tailscale or Twingate provider where offered. Break
glass validates the available access method and connector placement for
the target before the request is approved. See
Network providers for how each
path is configured.
How the credential is minted
The credential plane is where most of the variation lives:
The operational-command path supplies a credential through a
customer-approved recipe, using the same signing keypair as
operations. A recipe is a shell script:
it can read a secret from your customer’s secret store, run
psql or
kubectl, or launch a one-shot pod. Its approved code and inputs are
verified before execution. The recipe also defines how to revoke the
credential. Break glass delivers its credential output separately from
the connector’s Terraform state.
A credential’s own expiry depends on its type and recipe. A Kubernetes
token has a native expiry; a database credential may rely on the recipe’s
revoke action instead. The approved session duration does not give every
credential a native expiry.
“Out of band” does not mean the resource has no credential. It means
break glass isn’t the thing supplying it. The operator authenticates
with a credential they already hold or that your customer provided
directly; break glass only opens the network path.
The lifecycle
Every break glass session moves through the same shape, regardless of which planes it resolves:1
Request
An operator opens the Break Glass page in your vendor portal, picks one
resource and an available access method, and submits a reason and requested
duration. They share the generated approval link with your customer.
2
Approve
Your customer reviews the exact request (which resource, what privilege,
how long) and signs an approval with a private key that never leaves
their environment. They can also reject.
3
Connect
Where break glass supplies a credential, the appliance controller verifies
the signed approval against your customer’s pinned key before minting it.
For a connector session, your customer applies the reviewed connector
bundle using their own cloud credentials. An out-of-band session uses the
operator’s existing credential. The session becomes Active only when
its required access is ready.
4
Work
The operator uses the resource: fetches a ready-to-use kubeconfig and runs
kubectl, or connects to the database, and so on. Active starts the
approved session duration. A supplied credential can expire earlier if
the target caps its lifetime.5
Expire
At expiry or an earlier end, break glass starts revoking the credential
and temporary network access it supplied. Your customer destroys any
connector bundle they applied. Ended means the controller recorded
cleanup complete; it does not independently prove that every identity or
resource was deleted. Reported cleanup failures are retried and can fail
with an alert. Residual resources can need follow-up. Credential
self-expiry is a separate safeguard only where supported. Break glass
does not revoke an out-of-band credential. The request, signed approval
and cleanup are recorded.
The approved session duration starts at Active, after the required
access is ready. Time spent waiting for approval or preparation does not
count against that session window. A credential’s own expiry can be
earlier; the session clock does not extend it.