What is recovery?¶

Recovery is the way in on the day no directory can vouch for anybody. A console asks for a token, the answer needs the directory, and the directory is connected from that console. Recovery breaks that deadlock.

What proves you?¶

The proof is a ServiceAccount token minted for a mandatory audience and checked by the API server with a TokenReview. It is the only check that still asks the cluster anything. It depends on nothing but the API server.

Nothing is stored. The authority is the cluster's RBAC: who may mint a token for that account. You revoke it by removing a binding, and the audit log records it.

And a password?¶

Without an API server a password proves it, and the page's script proves it with SRP-6a and never sends it. A second account, conformance, is off by default, holds no group, and signs in only to clients marked harness. One recovery switch shuts both (ADR 0076).

What does it grant?¶

Nothing by itself. A recovered sign-in completes as the ServiceAccount subject. Only a service_account matcher in the policy puts that subject in a group.

What can the audit trail do to it?¶

A recovery sign-in is written durably before it completes, and refused when it cannot be written (audit). To use recovery, follow lost operator access.

Can it be turned off?¶

An operator who signed in through the identity provider can turn it off from the console, and nothing in the console turns it on again. That needs a new recovery.generation in the configuration. See turn off recovery.