Administer the deployment with a break-glass token when sign-in is unavailable.
Mint one in the cluster with kubectl exec deploy/<release>-orchestrator -- agent-orchestrator admin generate-token. It expires after 30 minutes by default, and every use is audited.
kubectl exec deploy/<release>-orchestrator -- agent-orchestrator admin generate-token