Operating the cluster

Running it after it is running. Six different jobs, and the ordering here is the order you will want them in.

Know what it is doing

Metrics on their own listener or pushed as OTLP, a Grafana pack and an alerting-rules file that are both tested against the registry they read. The guide also says which signals are worth alerting on. Read that part before an incident rather than during one. → Watch the gateway → Metrics reference · Audit trail reference

Ask it a question

The admin API answers one collection per endpoint, and the questions worth asking cross them. pistra query runs one SQL statement over the same collections as tables, each offered on the list endpoint’s own grant, so which key is nearest its budget is one statement rather than three calls and a script. → Query the gateway’s state

Know the record is intact

The audit trail is only evidence if its gaps are visible. pistra audit verify checks an exported trail offline: every record hashes to its entry, links to the one before it, and is signed by the key the chain started with. Witnessed heads catch the one deletion a chain cannot show by itself, a trail cut at the end. → Verify the audit trail → Ship the audit trail to your SIEM

Be able to put it back

All of the replicated state, keys, budgets, secrets, sources and audit heads, goes into one checksummed archive, restorable into whichever cluster receives it. → Back up and restore the cluster

When the cluster cannot elect a leader

Lost quorum has no automatic exit, and it should not have one. Dropping a member you cannot reach is a decision with a split-brain on the other side of it. pistra cluster recover makes that decision explicit, runs dry first, and names members by id rather than by address. → Recover a cluster that has lost quorum

The two doors for three in the morning

Stopping something now. A break-glass suspension takes a provider, key or rule out of service immediately, and expires on its own, because an emergency edit that lingers is how a deployment ends up in a state nobody chose. → Suspend a key, provider or rule

Getting in when sign-in is down. The local Unix socket authenticates by peer credentials, so it depends on no issuer and holds no secret. It has to be open beforehand to be a break-glass door at all. → Reach the admin API without your identity provider