Kill switch & restore

Admin guide

The kill switch is the single most powerful day-to-day lever Greenlight gives IT, and in the dashboard it is simply Pause. It stops a running app immediately by scaling its pod to zero and revoking the app’s workload credentials. The app’s data, secrets, repo, and audit history are preserved, so restore is always possible.

Every lifecycle action lives in one place: the power button in the top-right of the app’s detail page, which opens the app’s lifecycle menu. The menu only offers what the app’s current state allows, so you never pick an action that is about to be refused.

Menu item	When it appears	What it does
Pause	The app is running	Scales to zero and revokes workload credentials. The kill switch.
Restore	The app is paused	Brings it back with everything intact.
Still needed	Any live app	Confirms the app is in use, resetting the unused-app clock.
Retry deletion	A deletion is stuck	Re-runs the remaining teardown steps.
Delete…	Any app not already deleted	Permanent retirement.

When to use the kill switch

Use Pause when you need to stop the app now and work out the cause afterwards. Common triggers:

• The app is misbehaving — runaway loop, error spike, suspicious traffic.
• An integration credential has leaked through the app and rotation isn’t enough.
• A compliance or legal hold requires the app to stop until reviewed.
• You are about to retire the app and want to confirm nothing depends on it first.

The same action also serves planned maintenance and cost control — there is no separate “softer” pause. What differs is your reason for reaching for it, not the mechanism.

Pause an app

1. Open the app’s detail page and click the power button in the header.

2. Choose Pause. A confirmation asks you to confirm, and states plainly what is about to happen: the app scales to zero, its workload credentials are revoked, and users will see an outage until it is restored.

3. Confirm. The pod is scaled to zero and the workload proxy key is revoked. The app moves to Paused (suspended on the API).

The dashboard does not ask you to type a justification — it records that the app was paused from the dashboard, along with who did it and when. If the why matters for a later review, put it where your team will look for it: the app’s Knowledge, or your own incident record.

Note

Pause is offered only on a running app. If the menu doesn’t show it, the app is already paused, deploying, or failed — the menu reflects the state the server will accept rather than sending you into a refusal.

Restore an app

A paused app stays in the dashboard with its data, secrets, and history intact. Open its detail page, click the power button, and choose Restore. There is no confirmation step — restore is not a destructive action, and it is audited like every other.

Greenlight restores the workload access key and scales the app back up; the app moves back toward active once health checks pass. The restored app picks up where it left off. Database data is unchanged, secrets are unchanged, and the URL is the same. End users notice only that the app starts responding again.

Delete

Delete is the permanent retirement path, and it is available from the same menu on any app that isn’t already deleted — you do not have to pause it first.

Because there is no rollback, the confirmation asks you to retype the app’s slug before it will proceed. You retype it every time; a previous confirmation is never carried over.

When delete runs, Greenlight deletes the app namespace, DNS record, and container images, archives the GitHub repo (rather than deleting it, so history survives; a repo already deleted or moved out of Greenlight’s reach is recorded on the audit event and skipped), and drops the logical database. A configurable recovery window before that drop is planned but not yet available. The delete event is written to the audit log.

Teardown runs in the background, and the app sits in Queued for deletion while it does. If a step fails, the app stays there and the detail page names the step that is stuck — choose Retry deletion from the same menu to resume the remaining work.

Caution

Delete is not a troubleshooting step. Use it only for apps you have decided to permanently retire. Pause is the reversible option, and it is the right one for anything you are still investigating.

What the audit log captures

For every pause, restore, and delete:

• The actor’s user id, role, and session.
• The target app id, name, and previous state.
• How the action was made — a pause from the dashboard is recorded as such.
• The timestamp at the control plane.

Greenlight writes these events to the audit log. Full audit export is coming soon.

Next

App deployment & isolationThe Kubernetes objects affected by pause, restore, and delete.

Observability & auditWhere lifecycle events surface for review.

Governance & policyWho holds the kill switch and how it's audited.