Security

Breakglass

Just-In-Time Privilege Access Management for Kubernetes. Request, approve, and audit temporary elevated permissions with automatic expiration.

Learn More Get Started
Breakglass
01

Overview

Breakglass implements Just-In-Time Privilege Access Management.
Users create PrivilegeRequest resources specifying the role they need, duration, and justification. Policies evaluate requests and either auto-approve, require manual approval, or deny based on configurable rules.

When approved, the operator automatically creates RoleBindings or ClusterRoleBindings with precise expiration times. Every action taken during the elevated privilege window is captured in AuditLog resources and can be exported to external systems. When the duration expires, bindings are automatically removed; no manual cleanup required.

02

Features

Policy-Driven Approval

Define PrivilegePolicy resources with priority-based evaluation. Match requests by user, group, service account, role, namespace, or time window. Configure auto-approve, manual approval, or deny modes.

Multi-Approver Workflows

Require multiple approvers with configurable thresholds and deadlines. Approvers are validated against policy-defined users and groups.

Automatic RBAC Lifecycle

RoleBindings and ClusterRoleBindings are created on approval with owner references for cleanup. Bindings include metadata annotations for traceability. Automatic deletion on expiration or revocation.

Audit Log Export

Capture API server events during privilege windows via OpenShift Logging integration. Export to S3, Elasticsearch, Loki, or custom webhooks with configurable retry policies.

Escalation Prevention

Block cluster-admin grants by default. Define forbidden roles that can never be granted. Defense-in-depth validation at both webhook and controller levels.

Rate Limiting & Constraints

Limit concurrent active grants per user. Enforce cooldown periods between requests. Set maximum durations and require ticket references for compliance.

03

Use Cases

04

Custom Resources

05

Example Workflow

Here's how a typical privilege request flows through the system: 

# 1. User creates a PrivilegeRequest
  oc apply -f - <<EOF
  apiVersion: breakglass.cosmosdevops.co.uk/v1alpha1
  kind: PrivilegeRequest
  metadata:
    name: incident-response-123
    namespace: default
  spec:
    subject:
      kind: User
      name: [email protected]
    roleRef:
      kind: ClusterRole
      name: view
    scope:
      clusterWide: true
    duration: 2h
    reason: "Investigating pod crashes in payment service"
    ticketRef: "INC-12345"
  EOF

  # 2. Approver creates an approval
  oc apply -f - <<EOF
  apiVersion: breakglass.cosmosdevops.co.uk/v1alpha1
  kind: PrivilegeApproval
  metadata:
    name: approve-incident-123
    namespace: default
  spec:
    privilegeRequestRef: incident-response-123
    decision: Approved
    reason: "Verified incident ticket, approving temporary access"
  EOF

  # 3. Check status - bindings created, user has access
  oc get privilegerequest incident-response-123 -o jsonpath='{.status.phase}'
  # Output: Active

  # 4. After 2 hours, access automatically revoked
  oc get privilegerequest incident-response-123 -o jsonpath='{.status.phase}'
  # Output: Expired

Get Started with Breakglass

Implement Just-In-Time privilege access with policy-driven approvals, automatic expiration, and comprehensive audit trails.

Get Started